Altus iX Developer: XAML Deserialization RCE via Malicious Screen File

Altus iX Developer, a closed-source SCADA HMI engineering IDE, hands .ix screen file content to XamlReader.Load with no type sanitization. An ObjectDataProvider gadget triggers Process.Start on file open — a supply-chain attack against OT engineer workstations.