Xiaomi Mi AIoT Router AX3600 Firmware Collection and Related Information

I. Specifications

Specifications table


Hardware	CPU	1.4GHz quad-core A53 IPQ8071A
		Network processor
		ROM
		Memory
		2.4G Wi-Fi
		5G Wi-Fi
		Antennas
		Cooling
		Ports
		LEDs
		Reset buttons
		Power ports
		Standards
Wireless	Dual-band	2.4GHz and 5GHz
		Modulation
Software	Operating system	Mi Wi-Fi Smart Router OS based on a heavily customized OpenWrt version
		Wireless security
		Management
		Security

II. Stock ROM collection


China stock ROM	Version	Download
		1.0.17
		1.0.50
		1.0.66
		1.0.67
		1.0.74
		1.0.79
		1.1.15
		1.1.19
International stock ROM	Version	Download
		3.0.22

III. Enable OpenSSH on stock firmware

1. Downgrade the firmware

To enable OpenSSH, first downgrade to a vulnerable firmware version. Log in to the router and downgrade to 1.0.17 using the Xiaomi CDN or mirror. The router reboots after the downgrade.

Screenshots

2. Enable OpenSSH

After reboot, log in again. The URL contains a stok token:

http://192.168.31.1/cgi-bin/luci/;stok=d2d55f6e595e236044bfff0b444e2c51/web/home#router

Replace the remainder of the URL as follows, keeping your own stok value:

http://192.168.31.1/cgi-bin/luci/;stok=d2d55f6e595e236044bfff0b444e2c51/api/misystem/set_config_iotdev?bssid=Xiaomi&user_id=longdike&ssid=-h%3Bnvram%20set%20ssh%5Fen%3D1%3B%20nvram%20commit%3B

Press Enter. When the browser returns {"code":0}, run the second URL:

http://192.168.31.1/cgi-bin/luci/;stok=d2d55f6e595e236044bfff0b444e2c51/api/misystem/set_config_iotdev?bssid=Xiaomi&user_id=longdike&ssid=-h%3B%20nvram%20set%20ssh_en%3D1%3B%20nvram%20commit%3B%20sed%20-i%20's%2Fchannel%3D.*%2Fchannel%3D%5C%22debug%5C%22%2Fg'%20%2Fetc%2Finit.d%2Fdropbear%3B%20%2Fetc%2Finit.d%2Fdropbear%20start%3B

Alternatively, use this URL to change the root password to admin:

http://192.168.31.1/cgi-bin/luci/;stok=d2d55f6e595e236044bfff0b444e2c51/api/misystem/set_config_iotdev?bssid=Xiaomi&user_id=longdike&ssid=-h%3B%20echo%20-e%20'admin%5Cnadmin'%20%7C%20passwd%20root%3B

IV. Unofficial firmware

QSDK firmware

QSDK firmware is supplied by Qualcomm to vendors for customization. Its drivers are usually closed source and optimized for the device. The shared AX3600 build is based on OpenWrt 19.07 and kernel 5.4.89.

Enable the required environment variables over SSH:

nvram set flag_last_success=0
nvram set flag_boot_rootfs=0
nvram set boot_wait=on
nvram set uart_en=1
nvram set telnet_en=1
nvram set ssh_en=1
nvram commit

Use TFTP to copy xiaomimtd12.bin to /tmp, then run:

mtd write /tmp/xiaomimtd12.bin rootfs

Open the QSDK interface at 192.168.1.1, upgrade nand-ipq807x-single.img, and flash it once more after the partition table has changed. Finally, switch boot to the larger rootfs_1 partition:

fw_setenv flag_last_success 0
fw_setenv flag_boot_rootfs 0

Reference: right.com.cn