How to unbrick unifi6 plus AP through USB to Serial TTL?

[Ajay]

I flashed my UniFi 6 Plus AP with an OpenWRT image, and it worked fine for a few days. However, after a hard reboot (removing the PoE cable), the AP stopped responding and is no longer connecting.

I attempted to recover the device using TFTP mode, but it doesn't seem to be booting properly.

While searching online, I came across this guide that uses a USB to TTL connection to unbrick a UniFi device:

Unbricking a UniFi AP

Has anyone tried this method with the UniFi 6 Plus?
Can I safely follow the same process?

If anyone has faced a similar issue or has a confirmed working recovery method, please share your experience. Thanks in advance!

[bmork]

Please check the LED status when you power on the device with and without reset button. It should tell you a lot about the device state before OpenWrt is loaded. See:
https://help.ui.com/hc/en-us/articles/204910134-Understanding-Device-LED-Status-Indicators

Connecting to the console using a USB to TTL adapter is a good idea if you can't get TFTP recovery to work. But initially only to inspect the state! Don't write anything.

You should not follow any recovery guide for some other device. Post the output from the serial console here instead, and we'll do our best to help you interpret it. The failure you describe is unexpected and new to me. It will need to be analyzed before any action is taken.

Note that the U6+ is a Mediatek arm device with emmc flash. This is different from most other Unifi devices.

EDIT: wrt the TTL UART connection, I noticted that this info is missing from the device page. But there are som pics here:

Adding support for Ubiquiti UniFi 6 Plus (U6+)

I have the same experience. These things are much easier to open than they seem. Exactly like the U6 Lite. Here are a few pictures I took when I opened mine, showing where the tabs are. And also showing the serial pinout. Note that I connect Vcc because I use a bluetooth UART module. You don't want to do that if you are using a regular USB module. [c_20230909_204929] [c_20230909_204934] [c_20230910_101117] [c_20230910_101203] [u6plus-ble-ttl]

Note that the picture shows a bluetooth module where VCC is connected. You should only connect RX, TX and GND to a USB TTL adapter. They are powered from the USB cable, and connecting power from both sides is bad. Really bad. Don't do it.

The labels on the bluetooth shows which pin is which on the U6+. The picture shows a crossed RX - TX connection, which is what you want.

[elbertmai]

@Ajay

Has anyone tried this method with the UniFi 6 Plus?
Can I safely follow the same process?

No, the guide isn't applicable to U6+ for several reasons:

• It assumes you're using a UniFi controller, which obviously won't work with OpenWrt.
• U6+ is held together with 5 plastic clips around the circumference, not with Torx screws. You need a spudger tool to pry the two halves of the case open.
• The PCB is a different shape and does not have pin headers for the serial console. To attach a USB UART cable you need to solder or otherwise jury-rig a connection to the pin holes.

@Ajay

However, after a hard reboot (removing the PoE cable), the AP stopped responding and is no longer connecting.

Was it working fine before you cut power to the device? What was the reason for disconnecting it? These devices can tolerate sudden power-offs, so I have hard time believing this is the cause.

You didn't provide much detail on your TFTP recovery attempt. Can you confirm you're using these instructions from Ubiquiti themselves?

[Ajay]

Connecting to the console using a USB-to-TTL adapter is a good idea if you can't get TFTP recovery to work. But initially only to inspect the state! Don't write anything.

Thanks for your response.

Currently, no output is appearing in the minicom terminal.

Based on your shared screenshot, I’ve made the USB-TTL to AP connections as follows:

• GND connected
• AP TX → USB-TTL RX
• AP RX → USB-TTL TX

As per your suggestion, I’ve not connected any additional power supply, and I'm relying solely on PoE for power.

The baud rate is set to 115200.

I’m attaching photos of the current setup for reference.
Could you please review and let me know if anything seems incorrect or suggest further steps?

Thanks in advance.

[Ajay]

[Ajay]

Each time I can upload only one photo, so I uploaded photos 4 times.

[Ajay]

[frollic]

you could have skipped all photos + screen shot, then don't contain anything interesting ...

[Ajay]

@elbertmai

You didn't provide much detail on your TFTP recovery attempt. Can you confirm you're using these instructions from Ubiquiti themselves?

We followed the steps outlined in the link below. However, after rebooting, the device is no longer booting up. Even after performing a factory reset, the LED briefly turns white once, but we’re still unable to access TFTP recovery mode.

Please advise on how to proceed.

[OpenWrt Wiki] Ubiquiti UniFi 6 Plus

[bmork]

This looks correct to me, so I don't have a clue why it doesn't work. Note that reversing TX and RX is harmless, so it's an easy thing to test in case I got this wrong and mislead you.

Eh, except.... Do I see 5N1 in that minicom window? That doesn't sound right.

[elbertmai]

Why is your serial adapter set to 5N1? Modern computers don't use Baudot code, please set it to 115200 8N1 (115200 baud, 8 bits, no parity, 1 stop bit). Also check that the pin headers are actually making contact with the PCB holes. Hold them down with tape or rubber bands to ensure good electrical contact or you will get garbled or empty output.

@Ajay

We followed the steps outlined in the link below.

The only steps in that link are about installing OpenWrt on stock firmware, so I have no idea what you just did or why you followed that when I specifically asked for a TFTP recovery attempt. You need to actually do the TFTP recovery first and boot to a Ubiquiti shell (not an OpenWrt shell).

[bishoptf]

Bumping this older thread, I have a U6+ and trying to get it hooked up to a usb ttl to see if I can un-brick it. I saw your original threads where you were getting it working on OpenWrt but just trying to make sure I know the UART pinout. I know I will have to solder pins and that is no big deal just trying to make sure I do not do any additional damage. I have attached a pick of the uart section and using a meter where I see voltage and what I think rx and tx are located just would like to get some verification if possible, thanks.

[MakeWiFiGreatAgain]

I have that same cheap usb adapter. I don't know if they are all like this, but on mine the tx and rx are labeled backwards. yours might be backwards also. Simply swapping the tx and rx wires fixes this.

[bmork]

I believe all uap use the same pinout. The square marks vcc. The order of the other pins are as shown in

Note that people (me included) often are confused about tx and rx labels since it depends on which end of the link you describe. Mixing these up does not break anything. Just switch them if you don't see any output

[bishoptf]

Thanks for the quick reply, I was afraid when I took a meter to it that I saw 3.3v on multiple pins. I also missed up above there is a picture showing the connection to the same unit. I do understand about tx and rx and I can swap if needed. I might open another thread since I am not sure what I am going to see, the unit is bricked right now and will not go into tftp recovery or really respond to anything, The unit only displays a white light as soon as you power on and stays that way, no blinking no nothing. I figured this is a last ditch attempt to recover the unit if possible since it's a fairly new unit. Not sure what happened but I had a firmware issue pushed from the controller and something happened to the emmc, it was working but would not upgrade software wise. Ubiquity support had me run a rescue shell command which is here and after that it was borked.

 more U6Rescue.sh
sed -i '/\/sbin\/logread/ { /\/var\/log\/messages/d }' /etc/inittab
init -q
umount /dev/mmcblk0p10

ext_csd=$(cut -c536-539 /sys/kernel/debug/mmc0/mmc0:0001/ext_csd)
if echo "$ext_csd" | grep -q '^[0-9]\+b0$'; then
    echo "=== WARNING EXTCSD:0xb ==="
fi

devmem 0x11C10000 32 0x0a249249
echo 11230000.mmc > /sys/bus/platform/drivers/mtk-msdc/unbind
sleep 1
echo 11230000.mmc > /sys/bus/platform/drivers/mtk-msdc/bind
sleep 1
if [ -e "/sys/kernel/debug/mmc0/mmc0:0001/status" ]; then
    echo "Recovered"
    cat /sys/kernel/debug/mmc0/mmc0\:0001/ext_csd |cut -c536-539
    /usr/bin/syswrapper.sh upgrade https://dl.ui.com/unifi/firmware/UAPL6/6.7.23.15610/BZ.MT7981_6.7.23+15610.2507
07.1401.bin
else
    echo "Failed to recover eMMC"
fi

Not sure what I will find and not sure how I will recover but figured its worth a shot vs just throwing it in the recycle bin.

[bishoptf]

Finally got around to connecting it up and its not getting far on boot, issue with the image and not sure how I get a replacement loaded...if anyone has any suggestions let me know, here is the output from minicom:

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 103F 0000
F3: 0000 0000 [0200]
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [2000]
T0: 0000 01A0 [010F]
Jump to BL

NOTICE: BL2: v2.6(release):
NOTICE: BL2: Built : 15:00:55, Jun 17 2025
NOTICE: WDT: disabled
NOTICE: EMI: Using DDR3 settings

dump toprgu registers data:
1001c000 | 00000000 0000ffe0 00000000 00000000
1001c010 | 00000fff 00000000 00f00000 00000000
1001c020 | 00000000 00000000 00000000 00000000
1001c030 | 003c0003 003c0003 00000000 00000000
1001c040 | 00000000 00000000 00000000 00000000
1001c050 | 00000000 00000000 00000000 00000000
1001c060 | 00000000 00000000 00000000 00000000
1001c070 | 00000000 00000000 00000000 00000000
1001c080 | 00000000 00000000 00000000 00000000

dump drm registers data:
1001d000 | 00000000 00000000 00000000 00000000
1001d010 | 00000000 00000000 00000000 00000000
1001d020 | 00000000 00000000 00000000 00000000
1001d030 | 00a083f1 000003ff 00100000 00000000
1001d040 | 00000000 00000000 00020303 000000ff
1001d050 | 00000000 00000000 00000000 00000000
1001d060 | 00000002 00000000 00000000 00000000
drm: 500 = 0x8
[DDR Reserve] ddr reserve mode not be enabled yet
DDR RESERVE Success 0
[EMI] ComboMCP not ready, using default setting
BYTE_swap:0
BYTE_swap:0
Window Sum 564, worse bit 4, min window 68
Window Sum 568, worse bit 8, min window 68
Window Sum 386, worse bit 2, min window 46
Window Sum 404, worse bit 9, min window 48
Window Sum 396, worse bit 1, min window 48
Window Sum 420, worse bit 9, min window 48
Window Sum 408, worse bit 1, min window 50
Window Sum 428, worse bit 9, min window 52
Window Sum 418, worse bit 3, min window 50
Window Sum 444, worse bit 9, min window 52
Window Sum 428, worse bit 3, min window 50
Window Sum 452, worse bit 9, min window 54
Window Sum 436, worse bit 3, min window 52
Window Sum 446, worse bit 3, min window 54
Window Sum 468, worse bit 9, min window 56
Window Sum 452, worse bit 1, min window 56
Window Sum 470, worse bit 8, min window 58
Window Sum 460, worse bit 1, min window 56
NOTICE: EMI: Detected DRAM size: 256MB
NOTICE: EMI: complex R/W mem test passed
NOTICE: CPU: MT7981 (1300MHz)
ERROR: MSDC: CRC error occured while reading data with cmd=8, arg=0x0
ERROR: MSDC: CRC error occured while reading data with cmd=18, arg=0x3400
ERROR: BL2: Failed to load image id 3 (-2)

Not sure if there is away to stop the boot and load another image, looks pretty bricked to me which is a shame, again anyone have any ideas how to recover would appreciate it, thanks.

[frollic]

Try mtk_uartboot as described in https://openwrt.org/toh/zyxel/t-56.

[bishoptf]

I have been reading about the tool but it appears I need a bl2 firmware and not sure where to get one, will read through that thread, thanks.