CVE-2025-59981: junos space before 24.1 (exclusive), 24.1 · update r1, 24.1 · update r2 (+1 more affected versions); +1 more affected…

Affected technology

junos space · before 24.1 (exclusive)
juniper

junos space · 24.1 · update r1
juniper

junos space · 24.1 · update r2
juniper

junos space · 24.1 · update r3
juniper

Junos Space · 0 to before 24.1R4
Juniper Networks

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · Active user interaction

What an attacker can do

An attacker can inject script tags in the Device Template Definition page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator.This issue affects all versions of Junos Space before 24.1R4. Vendor/CNA’s CVSS 4.0 assessment (base score 5.1/10) rates confidentiality, integrity and availability impact as none.