OpenWrt support for Xiaomi AX3000NE

A brief summary of how I enabled SSH service:

I extracted the firmware of Xiaomi CR8806 because I found that they have a similar interface. In the file system, I discovered a service called elink, which related to Home Automation. It establishes a connection with the gateway's port 32768 after establishing an internet connection and registers itself to the gateway.

By decompiling this file, I found that it uses wget %s -O /tmp/update.bin to download firmware during system upgrades, and it does not check if the URL address is valid. So, if we input ; reboot ; as the address, it will execute our command (in this case, "reboot").


I wrote a Python program to implement this idea, and it works well with my device. I have already pushed it to my repo. I haven't done a lot of testing, if it doesn't work properly, please let me know or submit a PR :slight_smile:
@lazy.guy @hquu @shiguang55 @hank9999


Thanks for your hard working, I will try it! I need flash my device to mi firmware first.

I have tried this. It worked very well! My firmware version is 6.2.47(6.0.16)
I use a usb network share instead of a wifi netwrok to make sure my computer is online.


1 Like

Thanks a million for your great works and generous sharing!

This method is feasible, thank you

since we have access to ssh now, what else could we do to get a working openwrt firmware?

I see lots of MT7981 related pr recently so it seems to be supported.

Is your router a WR30U or an AX3000 NE

WR30U I know there's 3rd party firmware but still want to use the official one

Maybe you can extract the official Xiaomi firmware for the AX3000 NE and flash it to work on the wr30u

I am waiting 360 t7 support pr to be merged. This pr have some useful changes to MT7981. After it merged, i will try adding wr30u to main branch.


AS unlocking the AX3000NE SSH function needs run the scrip of, how can I get this scrip, is it this dts?

it's literally in the top three hits in (my) google search ("") ...

Check lee320's post, a repo link there.

You may find it on github link:
Could you please share us the dumped rom file after enabled ssh.

you can find atPatriciaLee3/wr30u_ssh (
Can you share the original partition backup information about AX3000 NE,
You can refer to this post,

any idea why its still not merged? its been there for 2 months

huh ?

no wr30u or ax3000ne?

ok, not the 360 t7 then :slight_smile:

did you check the wr30u commit? it was updated no later than 5 days ago.

yeah its already merged to other openwrt forks hope it can be done here soon