OpenWrt support for Xiaomi AX3000NE

A brief summary of how I enabled SSH service:

I extracted the firmware of Xiaomi CR8806 because I found that they have a similar interface. In the file system, I discovered a service called elink, which related to Home Automation. It establishes a connection with the gateway's port 32768 after establishing an internet connection and registers itself to the gateway.

By decompiling this file, I found that it uses wget %s -O /tmp/update.bin to download firmware during system upgrades, and it does not check if the URL address is valid. So, if we input ; reboot ; as the address, it will execute our command (in this case, "reboot").


I wrote a Python program to implement this idea, and it works well with my device. I have already pushed it to my repo. I haven't done a lot of testing, if it doesn't work properly, please let me know or submit a PR :slight_smile:
@lazy.guy @hquu @shiguang55 @hank9999


Thanks for your hard working, I will try it! I need flash my device to mi firmware first.

I have tried this. It worked very well! My firmware version is 6.2.47(6.0.16)
I use a usb network share instead of a wifi netwrok to make sure my computer is online.


1 Like

Thanks a million for your great works and generous sharing!

This method is feasible, thank you

since we have access to ssh now, what else could we do to get a working openwrt firmware?

I see lots of MT7981 related pr recently so it seems to be supported.

Is your router a WR30U or an AX3000 NE

WR30U I know there's 3rd party firmware but still want to use the official one

Maybe you can extract the official Xiaomi firmware for the AX3000 NE and flash it to work on the wr30u

I am waiting 360 t7 support pr to be merged. This pr have some useful changes to MT7981. After it merged, i will try adding wr30u to main branch.

1 Like