How to Enable SSH on Xiaomi BE6500 Pro / AX3000T
This is a quick guide for advanced users. If you get stuck, leave a comment with the exact step and error.
I. Requirements
- Xiaomi AX3000T running firmware 1.0.47.
- Xiaomi BE6500 Pro running firmware 1.0.46 (password: gwhx).
- MobaXterm, PuTTY, PowerShell, or an equivalent terminal application.
If the firmware is newer than the versions above, downgrade it with MiWiFi RepairTool.
II. Enabling SSH
- Log in to the management interface. The default IP is 192.168.31.1, and the password is the password you created during the initial router setup.
- After logging in, the URL should look like this:
http://192.168.31.1/cgi-bin/luci/;stok=d2d55f6e595e236044bfff0b444e2c51/web/home#router
- The text highlighted in red is the token. Copy it.
Open a Terminal, replace the token, and run the following requests in order:
- URL 1:
curl -X POST “http://192.168.31.1/cgi-bin/luci/;stok=d2d55f6e595e236044bfff0b444e2c51/api/misystem/arn_switch” -d “open=1&model=1&level=%0Anvram%20set%20ssh_en%3D1%0A”
- URL 2:
curl -X POST “http://192.168.31.1/cgi-bin/luci/;stok=d2d55f6e595e236044bfff0b444e2c51/api/misystem/arn_switch” -d “open=1&model=1&level=%0Anvram%20commit%0A”
- URL 3:
curl -X POST “http://192.168.31.1/cgi-bin/luci/;stok=d2d55f6e595e236044bfff0b444e2c51/api/misystem/arn_switch” -d “open=1&model=1&level=%0Ased%20-i%20’s%2Fchannel%3D.*%2Fchannel%3D%22debug%22%2Fg’%20%2Fetc%2Finit.d%2Fdropbear%0A”
- URL 4:
curl -X POST “http://192.168.31.1/cgi-bin/luci/;stok=d2d55f6e595e236044bfff0b444e2c51/api/misystem/arn_switch” -d “open=1&model=1&level=%0A%2Fetc%2Finit.d%2Fdropbear%20start%0A”
After URL 4, SSH should be enabled. Log in with user root and use the serial number to calculate the password.
Nhập SN của Router Xiaomi để tính toán mật khẩu root SSH.
SSH will not start automatically after a reboot, so the steps above must be repeated.
To keep SSH enabled, connect to the router over SSH with a Terminal and run:
zz=$(dd if=/dev/zero bs=1 count=2 2>/dev/null) ; printf ‘\xA5\x5A%c%c’ $zz $zz | mtd write - crash reboot
After the router reboots, log in to SSH again and run:
nvram set ssh_en=1 nvram set telnet_en=1 nvram set uart_en=1 nvram set boot_wait=on nvram commit bdata set ssh_en=1 bdata set telnet_en=1 bdata set uart_en=1 bdata set boot_wait=on bdata commit reboot
After the router reboots again, log in to SSH and run:
mtd erase crash reboot
Good luck!
Comments & Discussion
Share your thoughts, ask questions and feedback