Kimax U35WF Failsafe without WPS button

Hello everybody.
I recently firmware updated my Kimax U35WF router from lede-17.01.4-ramips-mt7620-u35wf-v1, looking for some new functionality to the device, but fell into the same hole as some reports about losing access to the device, even in wired mode. Searching the forums around, I managed to restore the user and password, but the login through the web interface makes me fall into "nothing", a blank screen. I did the necessary procedures to enter "failsafe" mode, but now another problem has arisen: the router does not have a WPS button. Using the "tcpdump" command, I can see when the router asks for a button to be pressed to enter the "failsafe" mode and then I get stuck. My question is whether there is a way to send a WPS button press signal via terminal for two seconds to establish the connection.

What about the reset button (located near the antenna)... usually pressing that repeatedly during the early phase of boot up should trigger failsafe mode (don't forget that you will need to be connected via ethernet and have your computer set to a static IP since DHCP does not run in failsafe mode; ssh is also required since LuCI will not be running, either).


If you have ssh access (again), just sysupgrade OpenWrt again (same version or newer, not keeping settings).

Yes, I did these steps and I can listen to the router, but pressing the reset button repeatedly, even in the initial boot phase, does not send any response in failsafe mode.

I can access login prompt on SSH command but no username/password is accepted.

I have some Kimax box & easy solution is with serial console


Did you set your Ethernet interface on the computer to a static ip in the subnet (any host address between 2-254) with a /24 subnet?

Did you try a persistent ping of as you booted the device and pressed the reset button?

This is the behavior with persistent ping, without any change when reset is pressed:

From icmp_seq=330 Destination host unreachable
From icmp_seq=331 Destination host unreachable
------------------ Before quick flashing LED: ------------
64 bytes of icmp_seq=332 ttl=64 time=1561 ms
64 bytes of icmp_seq=333 ttl=64 time=513 ms
64 bytes of icmp_seq=334 ttl=64 time=0.227 ms
64 bytes of icmp_seq=335 ttl=64 time=0.221 ms
64 bytes of icmp_seq=336 ttl=64 time=0.233 ms
64 bytes of icmp_seq=337 ttl=64 time=0.222 ms
64 bytes of icmp_seq=338 ttl=64 time=0.257 ms
64 bytes of icmp_seq=339 ttl=64 time=0.234 ms
64 bytes of icmp_seq=340 ttl=64 time=0.229 ms
64 bytes of icmp_seq=341 ttl=64 time=0.231 ms
-------- After quick flashing LED and always on: ---------
From icmp_seq=372 Destination host unreachable
From icmp_seq=373 Destination host unreachable
From icmp_seq=374 Destination host unreachable

Are you pressing the reset button after it has booted, or is this right after you apply power?

1 Like

I'll give it a try if the options don't help me, but I have to open the router one more time because the PCB design doesn't look like this one.

I test it both ways, but this behavior happens just by turning on the router.

test this

login : root
password : (nothing)

I can't access webpage login that way. SSH and Telnet don't work either.

Hi! This is the PCB design. It doesn't look like this one.

The serial is surely on the second card !!!

1 Like

I was never interested in this area, but I'm ready to change my mind about it.
My questions are do I have anything else to look out for besides soldering TX->RX, RX->TX and setting the communication speed with the device. Another question is what would be the appropriate firmware to make this flashing.

Yes TX->RX & RX->TX

Speed is if i remember 57600 for U-boot
115200 after boot with OpenWrt

Thanks to all for your help. I tried to do the soldering but I think I just messed up the PCB. :sleepy:
It is better to send the device for recycling. Even so, it was nice to have learned new things.