Mercusys mr90x bricked during installation

Installing and Using OpenWrt
1

Hello
I have or I had Mercusys AX6000 (MR90X) router.
I was trying to install openwrt 25.12.0 on my mr90x and everything was fine till ran the last command in the instruction:

19. Run sysupgrade:
sysupgrade -n /tmp/sysupgrade.bin

for my sysupgrade image
I used this code for modifying installed packages:

base-files busybox ca-bundle dnsmasq dropbear firewall4 fstools kmod-crypto-hw-safexcel kmod-gpio-button-hotplug kmod-leds-gpio kmod-mt7915e kmod-mt7986-firmware kmod-nft-offload kmod-phy-aquantia libc libgcc libustream-mbedtls logd luci mt7986-wo-firmware mtd netifd nftables odhcp6c odhcpd-ipv6only ppp ppp-mod-pppoe procd procd-seccomp procd-ujail uboot-envtools uci uclient-fetch urandom-seed urngd wpad-basic-mbedtls ethtool-full luci luci-ssl uhttpd liblua libubus libubus-lua libuci-lua lua luci-base luci-lib-ip luci-lib-jsonc luci-lib-nixio luci-mod-admin-full luci-theme-bootstrap rpcd luci-app-firewall luci-app-opkg luci-proto-ipv6 luci-proto-ppp luci-i18n-base-ru luci-i18n-firewall-ru luci-app-attendedsysupgrade luci-i18n-attendedsysupgrade-ru luci-i18n-opkg-ru unzip curl bind-dig htop mc luci-compat luci-lib-ipkg
kmod-nf-reject kmod-nf-reject6 kmod-nf-log kmod-nf-log6 kmod-crypto-crc32c kmod-nft-core kmod-nf-flow kmod-nf-tproxy kmod-nft-tproxy kmod-inet-diag kmod-tun kmod-phy-aquantia fitblk

and I used this script to run on first boot

uci set network.lan.ipaddr="192.168.0.100"
uci commit network

uci set wireless.@wifi-device[0].disabled='0'
uci set wireless.@wifi-iface[0].encryption='psk2'
uci set wireless.@wifi-iface[0].ssid="Owrt2.4"
uci set wireless.@wifi-iface[0].key="12345678-"
uci set wireless.@wifi-device[1].disabled='0'
uci set wireless.@wifi-iface[1].encryption='psk2'
uci set wireless.@wifi-iface[1].ssid="Owrt5"
uci set wireless.@wifi-iface[1].key="12345678-"
uci commit wireless

uci set system.@system[0].hostname='OpenWrt'
uci set system.@system[0].zonename='Europe/Moscow'
uci set system.@system[0].timezone='MSK-3'
uci commit system

I waited for like 10 mins but I couldn’t see any new wifi networks. and now I am in a state where I cannot get access to my router at all.

I tried to boot in failsafe mode, and as long as I understand router enters the failsafe mode as I can see the led constantly blinking really fast. But in failsafe mode I am unable to connect anyway via ssh/telnet/http. I tried all the ports on my router (lan0, lan1, lan2) I changed my static ip and tried to connect to 192.168.1.1 and 192.168.0.100. also for some reason I cannot see link led when I connect rj45 in any of ports on router while in failsafe mode.

I tried factory reset (hold 10 seconds wps button) but it didn’t change the situation at all.

So now I need to understand at this point is there any way to bring my router back to life?

Thanks in advance for your replies.

2

Very unlikely that dhcp server does not start for whatever reason, so set ip address in 192.168.1.1/24 network and try to connect via ssh only, then in that ssh sysupgrade using standard file.

You can install luci-i18n-ru which installs language pack for all installed luci components.

3

Should be able to recover via serial (UART) - https://git.openwrt.org/openwrt/openwrt/commit/?id=e4fe3097ef6a961874b66932a0ac4be18070630a

4

really appreciate your answer, but probably i wasn't that precise in my first post, i mean i actually have done this already. i setup a static ip address 192.168.1.5 on my eth port on pc, but there is no response on ping, ssh, telnet or http. so i tried to change ports for eth cable on my router, i tried all of them lan0, lan1, lan2, but had no luck as well. and as you can see in my first boot script i tried to change ip address of my router to 192.168.0.100. so i did all the same thing with static ip 192.168.0.5 on my pc, but had no response as well.

it looks like i am missing something.... i mean router doesn't look totally bricked... but i have no idea what should i do...

1 Like
5

This is wrong in OpenWrt 25.12 which uses address/cidr form, and not separate netmask value
Also it overlaps with default dhcp range of 100-250 and dnsmasq may reject to start in its validation wisdom.
Try arping and ping both addresses. Your package set is sort of valid for failsafe recovery (which is certainly 1.1)

6

Sorry my win os is on russian language, so all my logs are on russian as well, but I am sure you will get the point anyway

what I did:

  1. Entered failsafe mode, I mean I hope so because I can see led is blinking very fast
  2. Setup static ip address
PS C:\Users\user> ipconfig

Настройка протокола IP для Windows

Адаптер Ethernet Ethernet:

   DNS-суффикс подключения . . . . . :
   Локальный IPv6-адрес канала . . . : fe80::2bd3:654a:37ee:1020%10
   IPv4-адрес. . . . . . . . . . . . : 192.168.1.5
   Маска подсети . . . . . . . . . . : 255.255.255.0
   Основной шлюз. . . . . . . . . :

Адаптер беспроводной локальной сети Беспроводная сеть:

   DNS-суффикс подключения . . . . . :
   Локальный IPv6-адрес канала . . . : fe80::5ba6:63df:d258:366f%15
   IPv4-адрес. . . . . . . . . . . . : 192.168.0.142
   Маска подсети . . . . . . . . . . : 255.255.255.0
   Основной шлюз. . . . . . . . . : 192.168.0.1
  1. Installed zenmap for win and got this:
nmap -PR 192.168.1.1

Starting Nmap 7.98 ( https://nmap.org ) at 2026-03-08 13:56 +0300
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 3.24 seconds
  1. tried like this:
PS C:\Windows\system32> arp -d
PS C:\Windows\system32> ping 192.168.1.1

Обмен пакетами с 192.168.1.1 по с 32 байтами данных:
Ответ от 192.168.1.5: Заданный узел недоступен.

Статистика Ping для 192.168.1.1:
    Пакетов: отправлено = 1, получено = 1, потеряно = 0
    (0% потерь)
Control-C
PS C:\Windows\system32> arp -a

Интерфейс: 192.168.1.5 --- 0xa
  адрес в Интернете      Физический адрес      Тип
  224.0.0.22            01-00-5e-00-00-16     статический
  224.0.0.251           01-00-5e-00-00-fb     статический

Интерфейс: 192.168.0.142 --- 0xf
  адрес в Интернете      Физический адрес      Тип
  192.168.0.1           ac-84-c6-35-65-7c     динамический
  224.0.0.22            01-00-5e-00-00-16     статический
  1. disabled wifi interface and changed my static ip to 192.168.0.5 on eth int
PS C:\Windows\system32> ipconfig

Настройка протокола IP для Windows

Адаптер Ethernet Ethernet:

   DNS-суффикс подключения . . . . . :
   Локальный IPv6-адрес канала . . . : fe80::2bd3:654a:37ee:1020%10
   IPv4-адрес. . . . . . . . . . . . : 192.168.0.5
   Маска подсети . . . . . . . . . . : 255.255.255.0
   Основной шлюз. . . . . . . . . :

Адаптер беспроводной локальной сети Беспроводная сеть:

   Состояние среды. . . . . . . . : Среда передачи недоступна.
   DNS-суффикс подключения . . . . . :
  1. tried this:
PS C:\Windows\system32> arp -d
PS C:\Windows\system32> ping 192.168.0.100

Обмен пакетами с 192.168.0.100 по с 32 байтами данных:
Ответ от 192.168.0.5: Заданный узел недоступен.

Статистика Ping для 192.168.0.100:
    Пакетов: отправлено = 1, получено = 1, потеряно = 0
    (0% потерь)
Control-C
PS C:\Windows\system32> arp -a

Интерфейс: 192.168.0.5 --- 0xa
  адрес в Интернете      Физический адрес      Тип
  224.0.0.22            01-00-5e-00-00-16     статический
  224.0.0.251           01-00-5e-00-00-fb     статический
  1. from zenmap
nmap -PR 192.168.0.100	

Starting Nmap 7.98 ( https://nmap.org ) at 2026-03-08 14:05 +0300
mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 1.72 seconds

i mentioned it before, but is it normal that i cannot see any led blinking on my router's lan ports while in failsafe mode?
but on my win it looks good

PS C:\Windows\system32> netsh interface show interface

Состояние адм.  Состояние     Тип              Имя интерфейса
---------------------------------------------------------------------
Разрешен       Подключен      Выделенный       Беспроводная сеть
Разрешен       Подключен      Выделенный       Ethernet
7

Disconnect the secondary interfaces while recovering....
If the cable flops local network gets routed through other interface and intended recovery commands disappear in dark.

Run nmap -A , it kind of automatically gets around missing raw mode or ping and guesses running services.

Something is broken in you entering failsafe. It looks like 2 s fast blink, and if you succeed presing the button it starts blinking super fast and so keeps during whole recovery. Maybe it is other button....

8

i changed eth cable just in case, but result is the same

PS C:\Windows\system32> ipconfig

Настройка протокола IP для Windows


Адаптер Ethernet Ethernet:

   DNS-суффикс подключения . . . . . :
   Локальный IPv6-адрес канала . . . : fe80::2bd3:654a:37ee:1020%10
   IPv4-адрес. . . . . . . . . . . . : 192.168.1.7
   Маска подсети . . . . . . . . . . : 255.255.255.0
   Основной шлюз. . . . . . . . . :

Адаптер беспроводной локальной сети Беспроводная сеть:

   Состояние среды. . . . . . . . : Среда передачи недоступна.
   DNS-суффикс подключения . . . . . :
PS C:\Windows\system32> nmap -A 192.168.1.1
Starting Nmap 7.98 ( https://nmap.org ) at 2026-03-08 16:54 +0300
mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 2.21 seconds

and i recorded a video on bootup process for the router, i mean is it looks like the router in failsafe mode?
youtube video on bootup

9

Yes, router correctly enters failsafe.

10

i mean if router correctly enters failsafe mode there should be a way to get an access somehow, right?

11
1 Like
12

I checked your package list and all essential packages are in place.

Your uci script wipes LAN subnet mask thus only failsafe mode ssh root@192.168.1.1 can work.
Once there mount_root and in /etc/config/network change IP address to .99/24 and reboot, or sysyupgrade wiping config

boot script applies uci defaults before failsafe shell, so you have non-functional subnet in LAN, and only breaking, entering and soldering can salvage it.

13

sorry, but did I get it right if I will be able to connect to router through serial port then I will be able to run commands directly on router, right? So I will be able to change network configuration with commands like this:

uci set network.lan.ipaddr='192.168.1.55'
uci set network.lan.netmask='255.255.255.0'

and this should solve my connection issues, right?

14 
uci set network.lan.ipaddr='192.168.1.55/24'
uci commit network

edit: in failsafe mount_root first.

15

So what I need to do is:

  1. Bootup router in failsafe mode
  2. Connect to router through UART
  3. Give commands
mount_root 
uci set network.lan.ipaddr='192.168.1.55/24' 
uci commit network

And then reboot router, right?

1 Like
16

UART recovery is kinda difficult on this device. Needs soldering

17

Yes, thats correct.

18

OP kind of managed.

19

Why not use tftp initramfs recovery?

1 Like
20

Sorry, but how do I know does my router support tftp recovery or not? I was not able to find any information regarding this option. Or could I kindly ask you to share a guide about this method?

And If router supports tftp recovery, what should I do?

  1. get a working image – should I rename it before upload to tftp server?
  2. start an tftp server on my pc - what ip address should I use? Should I create any special folders etc?
  3. which lan port on router should I use to connect to my pc? lan0, lan1, lan2?
  4. Bootup router – how to force router to bootup from lan int and tftp? Should I push the wps button or hold it, or something else?
  5. Run commands:
mount_root 
uci set network.lan.ipaddr='192.168.1.55/24' 
uci commit network
  1. Reboot the router

is it correct?