Juniper Junos Space: stored XSS lets a low-privileged user run commands as a viewing administrator

CVSS 9.4CVE-2025-59978Firmware, BMC & network fabriccurated

Impact

A user who can write into Junos Space pages can store script that executes in the browser of any other user who views it, including an administrator, and so act with that administrator's permissions. Junos Space is the management application for Juniper switching and routing gear, so administrative control there means the ability to push configuration or images to the datacenter fabric itself - the network under the GPU nodes, not just a single host. The flaw is in the management web application, and it needs an administrator to view the planted content, which makes it slower than a direct RCE but no less far-reaching once it lands.

Who can reach it

Network, authenticated with low privilege, plus interaction: an attacker needs a Junos Space account that can store content and an administrator who then views the affected page. Reachable from wherever the Junos Space UI is exposed, normally the management VLAN.

What to do

Upgrade Junos Space to 24.1R4 or later; all earlier versions are affected per Juniper advisory JSA103140. This is an appliance/application upgrade of the management server - the managed switches and routers are not touched and do not need a reload, but Junos Space itself is out of service during the upgrade. Until then, limit who holds Junos Space accounts and restrict UI reachability to the management network.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-59978 https://supportportal.juniper.net/JSA103140

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.