Modbus TCP — unauthenticated by design; the protocol FrostyGoop and most BMS/CDU controllers speak
Port 502observed
| Value kind | observed — Reported measurements, counts, and specifications keep the precision and scope stated by their source; an exact specification is not treated as a range. |
|---|---|
| As of | 2024 |
| Source | Dragos / SANS ICS · What Is FrostyGoop section: malware directly interacts with ICS using Modbus TCP over port 502 |
| Review | checking…review by 2026-09-06 · standard cadence |
| Recorded changes | last 2026-06-29 |
| Claim id | modbus-tcp-unauthenticated-by-design-the |
Where the guide uses it
← Full numbers register — every date-stamped figure in the guide, with revision history.