A missing authentication vulnerability in Nginx-UI versions 2.0.0 through 2.3.7 allows unauthenticated remote attackers to hijack the initial administrator account during setup, resulting in complete system compromise.

This flaw is classified as a Missing Authentication for Critical Function issue (CWE-306) affecting the public API installation endpoint. An unauthenticated attacker can interact with the setup window without authorization due to inadequate request validation.

A successful exploit grants an unauthorized external entity complete administrative control over the Nginx-UI management plane. This can lead to unauthorized modification of web server configurations, interception or redirection of web traffic, and total compromise of underlying server confidentiality and integrity. The CVSS score of 8.1 reflects the severe operational risk and high technical impact associated with taking over administrative privileges.

Immediate Action: Update Nginx-UI to version 2.3.8 or later, where the installation endpoint properly authenticates setup requests.

Proactive Monitoring: Monitor network access logs for unauthenticated requests directed toward the installation API endpoint, especially on newly deployed instances.

Compensating Controls: Restrict external network access to the Nginx-UI setup endpoint using perimeter firewalls or internal VPN requirements until the application is fully configured and updated.

Public Exploit Available: No

Given the high CVSS score and the risk of complete administrative takeover, organizations running Nginx-UI must prioritize updating to version 2.3.8 immediately. Administrators should also ensure that initial instance deployments are performed behind trusted internal networks to mitigate exposure during the setup phase.