Modbus
The lingua franca of industrial controllers; unauthenticated by design, so anything that can reach the network can command a chiller or CDU without exploiting a vulnerability.
Current numbers
600 buildings / ~2 daysFrostyGoop district-heating incident: malicious Modbus commands; distinguish the associated firmware action
Port 502Modbus TCP — unauthenticated by design; the protocol FrostyGoop and most BMS/CDU controllers speak