Classic Modbus TCP is unauthenticated, and FrostyGoop used it; Claroty finds over 80% of data-center OT control, power-monitoring and IoT systems on BACnet/Modbus-class legacy protocols
Port 502observed
| Value kind | observed — Reported measurements, counts, and specifications keep the precision and scope stated by their source; an exact specification is not treated as a range. |
|---|---|
| Caveat | Classic Modbus TCP on port 502 has no authentication. The Modbus Organization's Modbus Security Protocol wraps Modbus in TLS with X.509v3 certificates on port 802; devices that support it authenticate their peers. |
| As of | 2024 |
| Source | Dragos / SANS ICS (FrostyGoop, port 502); Claroty Team82, State of CPS Security: Data Center Exposures (2026-07-29) · What Is FrostyGoop section: malware directly interacts with ICS using Modbus TCP over port 502 |
| Review | checking…review by 2027-04-16 · standard cadence |
| Recorded changes | last 2026-10-16 · 2 revisions tracked |
| Claim id | modbus-tcp-unauthenticated-by-design-the |
Where the guide uses it
← Full numbers register — every date-stamped figure in the guide, with revision history.