CVE-2025-59987: Junos Space: The arbitrary device search field is vulnerable to reflected cross-site script injection
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the arbitrary device search field that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator.This issue affects all versions of Junos Space before 24.1R4.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59987?
CVE-2025-59987 is considered a high-severity vulnerability due to the potential for cross-site scripting attacks.
How do I fix CVE-2025-59987?
To fix CVE-2025-59987, update Juniper Networks Junos Space to version 24.1R4 or later as per vendor recommendations.
What products are affected by CVE-2025-59987?
CVE-2025-59987 affects Juniper Networks Junos Space versions prior to 24.1R4.
What type of attack is enabled by CVE-2025-59987?
CVE-2025-59987 allows attackers to perform cross-site scripting (XSS) attacks by injecting malicious scripts into search fields.
Can I still use Junos Space if I am affected by CVE-2025-59987?
It is highly recommended to update to the fixed version to mitigate the risks associated with CVE-2025-59987.