Your Docking Station Has a Patching Problem

Summary: One BIOS setting can stop a dock from updating, and two dock CVEs live in the update tools themselves. Here’s how docks end up unpatched, and what to check on DMA protection. 

The easiest way to leave a dock unpatched is to lock down the laptop it’s plugged into. Dell’s support article for the HD22Q, WD19 and WD22TB4, last modified on May 22, 2026, spells it out.

With “Enable External USB Port” off and Type-C dock LAN on, the dock’s LAN port stops working and Dell’s Firmware Utility can’t update the dock. A hardening setting takes patching down with it. 

That’s one way docks go stale. The second is stranger: the tools that update them have been vulnerable too. 

Hardening can strand the dock

Dell’s article isn’t the only place lockdown and docks collide. Microsoft’s USB4 design guidance says PC makers may offer a firmware option to disable PCIe tunneling as a security feature.

With it on, Windows creates no PCIe tunnels, and Thunderbolt 3 docks may fail to enumerate because their USB functions sit behind a PCIe-attached controller.

Microsoft suggests turning off Thunderbolt 3 alternate mode so the dock falls back to USB 3.x and DisplayPort. 

So before you push a baseline, sort the docks you own by connection type. Microsoft’s warning is about Thunderbolt 3 docks specifically.

If your inventory doesn’t record that, a dock comparison tool that filters by connection type, operating system and Mac chip can help you look up what a given model uses.

Then pilot the setting on a few desks and check that dock updates still run. 

The updater is part of the attack surface

Dell’s firmware 01.00.36 for the WD19 and WD22TB4 is the fix named in two advisories. DSA-2023-362 (CVE-2023-43078) is an improper link resolution flaw in the firmware update utility that can lead to privilege escalation or denial of service.

Dell scores it 6.7 Medium, and NVD scores it 7.3 High. Lenovo’s update tool for its ThinkPad Hybrid USB-C with USB-A dock had a local privilege escalation of its own (CVE-2022-4569, 7.8 High). The thing you run to patch the dock was the weak spot. 

The firmware has had advisories too. DSA-2024-014 (CVE-2023-28396) concerns an Intel Thunderbolt component.

Dell lists a driver and rates it Medium, while NVD describes improper access control in Intel Thunderbolt controller firmware, with a local attack vector and a 6.1 Medium CVSS 3.1 score from Intel.

DSA-2025-218 (CVE-2025-36573) covers the Dell Pro Smart Dock SD25 and SD25TB4: firmware before 01.00.08.01 writes sensitive information to a log file. Dell gives it 7.1 High, and NVD’s own score is 5.5 Medium. 

All four have a local attack vector, so an attacker needs a foothold on the machine first.

That makes them privilege-escalation and patch-hygiene problems, and each advisory names a fixed version. This post makes no claim about exploitation. 

Different tools update different parts

On Linux, fwupd’s Dell dock plugin updates the USB hubs and the embedded controller, and can update the MST controller.

Those updates apply the next time the dock’s USB-C cable is unplugged from the host.

A separate fwupd plugin handles the Thunderbolt controller. On Windows, the Dell article above points to Dell’s Firmware Utility. Someone has to own that process for the docks on your desks. 

Where DMA protection fits

The other half of the dock story is memory access. Thunderbolt, USB4 and CFexpress are PCIe hot-plug interfaces, so a connected device can read and write system memory without the CPU’s involvement, unless the IOMMU blocks it.

Microsoft describes drive-by DMA attacks as ones that happen while the owner is away, take minutes, use cheap off-the-shelf hardware and need no disassembly of the PC. 

Intel’s 2020 Thunderbolt 4 announcement set VT-d-based DMA protection as a requirement for Thunderbolt 4 computers.

ByrdPilot’s Thunderbolt 4 vs USB-C dock guide goes through those host requirements, including Microsoft’s DMA remapping for USB4 host routers. 

Whether protection is on depends on the host. On Windows Pro, Enterprise and Education, Kernel DMA Protection uses the IOMMU to block external devices whose drivers don’t support DMA remapping, by default until someone signs in or unlocks the screen.

It doesn’t cover boot, which over Thunderbolt 3 ports is the firmware’s job. And the status can read OFF when VT-d is disabled in UEFI. 

Two pieces of research show what goes wrong when those details slip. Thunderspy, published in 2020, described attacks on Thunderbolt 1, 2 and 3 that, per the researchers, let someone with brief physical access read data from a locked or sleeping machine.

They say Kernel DMA Protection only partly mitigates it, and that Intel declined to issue CVEs. Thunderclap, presented in 2019, used an FPGA device posing as a network card to show weaknesses in how operating systems use the IOMMU.

Microsoft enabled IOMMU support for Thunderbolt in Windows 10 1803 after the disclosure. Both predate Thunderbolt 4’s July 2020 launch announcement, and I’m making no claim about how either attack fares against Thunderbolt 4 hosts. 

One more thing to inventory

Dell’s SD25TB4 shows what an enterprise dock can add on the network side. Its user guide lists PXE boot, plus MAC Address Pass-Through and Wake-on-LAN on select computers.

If you track or allow devices by MAC address, find out what a docked laptop presents on the wire. 

What to check

1. On a docked Windows machine, check Memory access protection under Windows Security, Device security, Core isolation details (or run msinfo32). If it shows OFF and virtualization in firmware reads No, Microsoft says to enable Intel Virtualization Technology and Intel VT-d in UEFI.

2. Review your DmaGuard policy for incompatible devices, and note which machines sit in the allowed state.

3. Put every dock in the asset inventory with its model, connection type, firmware version and a named owner.

4. Pilot your lockdown settings, including the external USB port and PCIe tunneling, on a few desks, and confirm dock updates still run.

5. Patch the update tools too. Dell’s DSA-2023-362 and Lenovo’s CVE-2022-4569 are both flaws in the tools themselves.

6. On Apple silicon laptops the default asks you to approve a new accessory, and the Mac has to be unlocked to approve it. Apple’s platform guide also describes a separate IOMMU for each DMA agent, PCIe and Thunderbolt ports included. The design differs from Windows, so don’t assume a Windows policy maps across.

A dock with a firmware version, a patch owner and a tested baseline is something you can manage.