Ubiquiti Bullet M2 / M5

Warning! There are two versions of Ubiquiti Bullet: xm and xw.

The old xm version has limited RAM (32 MB) and thus is not recommended.

WARNING: On the Bullet M2 xw, OpenWrt 21.02.1 never turns the Ethernet port on. TFTP can be used to revert to OpenWrt 19.07. See https://github.com/openwrt/openwrt/issues/9178 and https://owenh.net/bulletm2hp. The fix (commit e405b96fe774) is now in the main, 22.03, and 23.05 branches and should be included in OpenWrt 22.03.7 and 23.05.3 when those are released.

OpenWrt 19.07.5 (at least) can be installed on a Bullet M2HP XW device by using the automated process in the true-systems/ubnt-openwrt-flashing repository on GitHub.

  1. Install the stock AirOS firmware XW.v6.1.7.32555.180523.1754.bin. The SHA256 hash should be c6e36003ab82b588936b558dfaf06fd2e54e3bd63b84f17687e023de55f05b23.
  2. Clone the true-systems/ubnt-openwrt-flashing repository. The working commit as of this writing was 7b89450ca1afa9503ae449b6b15daef4cf2ade96.
  3. Update the REMOTE_UBNT variable in the Makefile if necessary.
  4. Download the OpenWrt 19.07.5 factory image. The SHA256 hash should be e2784584dc8a0dc8fca775d98ebac4796f94e85bde8f422b944511bb834be3b5.
  5. Run make flash-factory FW_OWRT=openwrt-19.07.5-ath79-generic-ubnt_bullet-m-xw-squashfs-factory.bin to patch the firmware updater and flash OpenWrt to the device. A backup of the stock firmware will be saved to firmware-backup.bin (and there is a make target for restoring it).

This process is also published at owenh.net/bulletm2hp.


Downgrade to:





Do not flash a device that has AirOS firmware beyond v.5.5.10 or you will brick your device! You must first revert to version 5.5.10 and then flash OpenWrt https://community.ubnt.com/t5/airOS-SDK-Custom-Development/5-6-2-TFTP-ERROR/m-p/1307614/highlight/true#M2349. If you've already bricked your device, you may try to recover it https://community.ubnt.com/t5/airOS-SDK-Custom-Development/AirMAX-Device-Firmware-Recovery-Procedure/m-p/1499583/highlight/true#M2499.

To flash an already running bullet with original firmware (AirOS) on CLI, you must do this:

ssh root@yourbullet

wget -O /tmp/fwupdate.bin "$url"
/usr/sbin/fwupdate -m

If you prefer TFTP, than you can update via holding down the reset-button for 10 seconds on startup, and send the firmware to
See →generic.flashing or →generic.flashing.tftp for instructions.


This section must be wrong since Bullet M2 should use Uboot.

Probably this is for Bullet2 (not M2).

FIXME If the bullet firmware was changed using Fon Flash using files ...atheros-root.squashfs and ...atheros-vmlinux.lzma the Redboot will have been changed. The result will be that the ubnt recovery method will no longer work.

To fix connect to your router using a serial cable and change the redboot to the below config.

RedBoot> fconfig -l
Run script at boot: true
Boot script:
.. cache off
.. fis load -d -e kernel
.. go

Boot script timeout (1000ms resolution): 1
Use BOOTP for network configuration: false
Gateway IP address:
Local IP address:
Local IP address mask:
Default server IP address:
Console baud rate: 9600
GDB connection port: 9000
Force console for special debug messages: false
Network debug at boot time: false


This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2024/02/15 18:52
  • by owenh