Modbus
The lingua franca of industrial controllers; unauthenticated by design, so anything that can reach the network can command a chiller or CDU without exploiting a vulnerability.
Current numbers
600 buildings / ~2 daysheat lost in Lviv via FrostyGoop — Modbus firmware downgrade, no zero-day
Port 502Modbus TCP — unauthenticated by design; the protocol FrostyGoop and most BMS/CDU controllers speak