How to Unlock SSH on Xiaomi Routers with Vulnerable Stock Firmware

0. Firmware versions affected by the vulnerability

1. Downgrade the firmware

• To enable OpenSSH, first downgrade the firmware to one of the vulnerable versions listed in section 0.
  • Log in to the router’s management page and downgrade to a vulnerable version.

Screenshot

• The router will reboot automatically after the downgrade.

2. Enable OpenSSH

• After the router reboots, log in to its management page again. The URL should look similar to this:

• Replace the token in the URL with the copied token, using a request similar to this:

• Press Enter. If the screen shows {"code":0}, continue with the next request.

Log in to SSH with the username root.

• Obtain the root password from the serial number:

  Tra cứu mật khẩu SSH từ Serial Number (Xiaomi)

  Nhập số Serial Number (SN) in dưới đáy router Xiaomi để tự động tính toán mật khẩu root SSH.

  Tính mật khẩu

  Mật khẩu root SSH:

  SAO CHÉP

• Or use this request to change the root password to admin (root/admin):

Reference: https://www.right.com.cn/ If you have questions, leave a comment. Good luck!