What’s Vulnerable › Vulnerabilities

CVE-2021-33838

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-06-04 · updated 2026-06-17
• Weakness: CWE-203

Description

Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because requests related to Check-In State occur shortly after requests for Phone Number Registration.

Affected products

• Luca-App Luca: through 1.7.4

References

• https://github.com/mame82/misc/blob/master/luca_traceIds.md
• https://luca-app.de/securityoverview/properties/objectives.html
• https://www.ccc.de/de/updates/2021/luca-app-ccc-fordert-bundesnotbremse
• https://www.youtube.com/playlist?list=PLKuX6iczGb3kuDsm2RFgbmRkTugkR9-UE
• https://github.com/mame82/misc/blob/master/luca_traceIds.md
• https://luca-app.de/securityoverview/properties/objectives.html
• https://www.ccc.de/de/updates/2021/luca-app-ccc-fordert-bundesnotbremse
• https://www.youtube.com/playlist?list=PLKuX6iczGb3kuDsm2RFgbmRkTugkR9-UE

Get alerted when CVE-2021-33838 or the next vulnerability affects your stack