German COVID-19 Contact-Tracing Vulnerability Allowed RCE

A security vulnerability in the infrastructure of Germany’s official COVID-19 contact-tracing app, called the Corona-Warn-App (CWA), would have allowed pre-authenticated remote code execution (RCE).