As schroeder already said, it depends on what exactly you are attacking. What you describe is essentially "Remote Code Execution". You want remote access to a device, without user interaction being neccessary. In this case, you need some kind of bug in a component which can be reached from outside, allowing you to send malicious data and cause unintended behaviour.
Take a look at Stagefright for example. It was a flaw in the way Android handles MMS. Sending a specific forged MMS could exploit this flaw and gain access to the device.
WannaCry was a little bit different. Afaik it used two ways of distribution. Either simple mechanisms like executing an .exe file, unconsciously activating Word macros, etc. OR by exploiting a bug in the Windows OS, which was unknown until then, as the NSA held it back. This bug allowed it to spread on its own by scanning reachable hosts for the vulnerability and installing itself on them, using an exploit for said bug.
Unknown bugs which can be used to gain remote code execution are extremely dangerous. Here in Germany, the company "Deutsche Bahn" was neraly shut down due to many many machines being infected (even the screens in the train station telling about delays and plans).