Open redirect via unvalidated redirection input

Open redirect in Siemens SIMATIC controller web servers allows remote attackers to redirect users through an attacker-crafted link. The web server accepts attacker-controlled redirection input without validating the destination URL before issuing the redirect. Exploitation requires no authentication but requires a legitimate user to click the crafted link, after which the browser is sent to an attacker-chosen site.