Ubiquiti Bullet M2 / M5

Warning! There are two versions of Ubiquiti Bullet: xm and xw.

The old xm version has limited RAM (32 MB) and thus is not recommended.

ModelVersionSoCCPU MHzFlash MBRAM MBWLAN HardwareWLAN2.4WLAN5.0100M portsGbit portsModemUSB
Bullet M XM (AR7240)Atheros AR7240400832Atheros AR9283-a/n1---
Bullet M XM (AR7241)Atheros AR7241400832Atheros AR9283-a/n1---
Bullet M xwAtheros AR9342¿864Atheros AR9342b/g/na/n1---

Install OpenWrt (generic explanation)


Downgrade to:





Do not flash a device that has AirOS firmware beyond v.5.5.10 or you will brick your device! You must first revert to version 5.5.10 and then flash OpenWrt https://community.ubnt.com/t5/airOS-SDK-Custom-Development/5-6-2-TFTP-ERROR/m-p/1307614/highlight/true#M2349. If you've already bricked your device, you may try to recover it https://community.ubnt.com/t5/airOS-SDK-Custom-Development/AirMAX-Device-Firmware-Recovery-Procedure/m-p/1499583/highlight/true#M2499.

To flash an already running bullet with original firmware (AirOS) on CLI, you must do this:

ssh root@yourbullet

wget -O /tmp/fwupdate.bin "$url"
/usr/sbin/fwupdate -m

If you prefer TFTP, than you can update via holding down the reset-button for 10 seconds on startup, and send the firmware to
See →generic.flashing or →generic.flashing.tftp for instructions.


This section must be wrong since Bullet M2 should use Uboot.

Probably this is for Bullet2 (not M2).

FIXME If the bullet firmware was changed using Fon Flash using files …atheros-root.squashfs and …atheros-vmlinux.lzma the Redboot will have been changed. The result will be that the ubnt recovery method will no longer work.

To fix connect to your router using a serial cable and change the redboot to the below config.

RedBoot> fconfig -l
Run script at boot: true
Boot script:
.. cache off
.. fis load -d -e kernel
.. go

Boot script timeout (1000ms resolution): 1
Use BOOTP for network configuration: false
Gateway IP address:
Local IP address:
Local IP address mask:
Default server IP address:
Console baud rate: 9600
GDB connection port: 9000
Force console for special debug messages: false
Network debug at boot time: false


This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2021/01/02 18:26
  • by danitool