diff --git a/src/generic-methodologies-and-resources/pentesting-wifi/README.md b/src/generic-methodologies-and-resources/pentesting-wifi/README.md
index 6abcdeb3042..d82e50116a3 100644
--- a/src/generic-methodologies-and-resources/pentesting-wifi/README.md
+++ b/src/generic-methodologies-and-resources/pentesting-wifi/README.md
@@ -1062,6 +1062,67 @@ Some consumer IoT relays/controllers keep the commissioning **open AP** active a
 
 For persistence, leave the commissioning AP enabled.<sup>[[2]](#references)</sup>
 
+## Serial-in-SSID PSKs & dual-homed battery gateways (GivEnergy AIO case)
+
+Many IoT gateways broadcast their serial in the SSID **and** derive the WPA PSK from that same serial, so the wireless password is readable from the air with no handshake capture or cracking. GivEnergy "All In One" battery gateways show the full chain, from Wi-Fi association to a foothold on the customer's home LAN and access to any customer's cloud data.<sup>[[30]](#references)</sup>
+
+### 1. Recover the AP PSK from the SSID
+
+The gateway advertises an SSID of the form `WK<SERIAL>` (e.g. `WK12345G67`), and:
+
+- Older units shipped a fixed PSK of `12345678`.
+- The installer manual then told installers to **use the inverter serial number as the Wi-Fi password** — but that serial is already inside the broadcast SSID.
+
+So you associate to the commissioning AP just by reading its name; there is no WPA4-way handshake to crack. Because the SSID pattern is fixed, you can pre-locate targets by searching wardriving datasets (e.g. wigle.net) for the `WK` prefix, though exploitation still needs radio proximity or another route to the gateway.
+
+### 2. Telnet admin/admin on the Wi-Fi module → steal the home Wi-Fi PSK
+
+The device is **dual-homed**: it keeps its own AP up while also joining the customer's home WLAN as a station (STA), and installers are told to additionally cable its RJ45 to the home router when close. Once on the AP side, the embedded **Hi-Flying HF-A21-SMT** Wi-Fi module exposes its own management surface:
+
+| Service | Port | Notes |
+|---|---|---|
+| Telnet | 23 | HF-A21 module console, default `admin`/`admin` |
+| HTTP | 80 | Embedded web server, default `admin`/`admin` |
+| Modbus TCP | 502 | Battery control |
+| Vendor API | 8099 / 8899 | Battery control / data |
+
+Logging into Telnet with `admin`/`admin` gives commands that dump the module configuration **including the home WLAN PSK in cleartext** (the same class of bug as the 2015 iKettle). At that point you drop off the commissioning AP and authenticate straight onto the victim's home network — or just use the Ethernet bridge if it was cabled in.
+
+```bash
+# after joining the WK<serial> AP and getting a lease
+ip route | grep default              # find the gateway/module IP
+telnet <module_ip> 23                # admin / admin, then read the STA config for the home PSK
+```
+
+### 3. Battery control via Modbus/API
+
+Reaching the module also exposes the battery-control plane on Modbus TCP `502` and the vendor API on `8099`, which can **force the battery not to charge/discharge**, rendering it useless. Continue in [Pentesting Modbus](../../network-services-pentesting/pentesting-modbus.md) and [Pentesting Telnet](../../network-services-pentesting/pentesting-telnet.md).
+
+### 4. Cloud IDOR: serial number as an object selector
+
+The serial you read from the SSID also unlocks other customers' data in the vendor cloud. The internal API took the serial straight from the path with no ownership check:
+
+```http
+GET /internal-api/inverter/data/CH12345678/2024-05-23
+```
+
+Swapping the serial returns another customer's grid power, voltage, generation, consumption, battery state and export data. A serial number is an **object selector, not proof of ownership** — test it as a classic IDOR/BOLA with two accounts you control, see [IDOR/BOLA testing](../../pentesting-web/idor.md).
+
+### 5. Port scan = factory reset (destructive DoS)
+
+The HF-A21 network stack is fragile: **a normal aggressive port scan can crash the module, and it comes back at factory defaults** rather than merely rebooting — wiping charge/discharge config and reverting to the default SSID/credentials. Two consequences for testing:
+
+- Probe embedded gateways **one port at a time and slowly**, not with a full-rate `nmap`:
+
+  ```bash
+  for p in 23 80 502 8099 8899; do
+      nc -nvz -w 2 <gateway_ip> "$p"
+      sleep 1
+  done
+  ```
+
+- If ARP/management responses drop and a default SSID or default credentials reappear, you have hit the reset/DoS boundary — record state beforehand and keep physical recovery access.
+
 ## References
 
 - [1] [Wifiphisher - The Rogue Access Point Framework](https://github.com/wifiphisher/wifiphisher)
@@ -1093,5 +1154,6 @@ For persistence, leave the commissioning AP enabled.<sup>[[2]](#references)</sup
 - [27] [en.wikipedia.org - Extensible Authentication Protocol](https://en.wikipedia.org/wiki/Extensible_Authentication_Protocol)
 - [28] [intel.com - Network And I O - Wireless Networking](https://www.intel.com/content/www/us/en/support/articles/000006999/network-and-i-o/wireless-networking.html)
 - [29] [interlinknetworks.com - App Notes - Eap Peap](https://www.interlinknetworks.com/app_notes/eap-peap.htm)
+- [30] [GivEnergy enters administration, batteries expose home networks](https://pentestpartners.com/security-blog/givenergy-enters-administration-legacy-home-batteries-still-expose-customer-networks)
 
 {{#include ../../banners/hacktricks-training.md}}