Vulnerability in Juniper Junos Space
CVE-2025-59976
An arbitrary file download vulnerability in the web interface of Juniper Networks Junos Space allows a network-based authenticated attacker using a crafted GET method to access any file on the file system. Using specially crafted GET methods, an attacker can gain access to files beyond the file path normally allowed by the JBoss daemon. These files could contain sensitive information restricted from access by low-privileged users.This issue affects all versions of Junos Space before 24.1R3.
EPSS: 0.003 (18.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Juniper Junos_space — versions 24.1
- Juniper Networks Junos Space — versions 0
Weakness classification (CWE)
References
- sirt@juniper.net (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-59976?
- CVE-2025-59976 is a medium-severity vulnerability in Juniper Junos Space, classified under Files or Directories Accessible to External Parties. CVSS score: 6.5/10. Published 2025-10-09.
- How severe is CVE-2025-59976?
- Medium severity. CVSS v3 base score is 6.5 out of 10.