How to reflash the Xiaomi gateway: an expert guide

Modern smart homes are often built on the Xiaomi ecosystem, where the centerpiece is a gateway or hub that combines sensors, lamps and outlets. However, over time, the regular software may work unstable, require a paid subscription for local management or simply need to expand functionality.

Flashing is not just an update through the settings menu, but a deep system operation that requires an understanding of network protocols and device architecture. Mistakes can lead to a device becoming a brick, losing the ability to turn on and respond to commands, which is why it is important to be clear about the entire path ahead and have the necessary tools at hand to restore the system in the event of a failure.

In this article, we will discuss all the stages of preparing and executing a replacement software, paying special attention to security measures and technical nuances of various hub models, you will learn how to obtain superuser rights, what tools will be required to interact with the file system and how to avoid the typical mistakes made by beginners when working with network equipment.

Preparation of equipment and software

Before you start any manipulation of system software, you need to assemble a full set of tools. You will need the Xiaomi gateway itself, a computer with a Windows or Linux operating system, and an Ethernet cable (twisted pair). Some models, such as Gateway v2 or v3, may need to disassemble the case, so prepare a plastic blade and a set of screwdrivers.

Special attention should be paid to the software part. You need to install a command line terminal on your computer, such as Putty or Tera Term, and a Telnet emulation utility if it is not built into your OS by default. Without these utilities, you will not be able to access hidden partitions of the system.

Don’t forget to download the current system image in advance. Xiaomi gateways most often use OpenWrt-based images adapted to a specific hardware platform. Download should only occur from trusted repositories to eliminate the risk of malicious code being introduced into your home network.

Access to the command line (Telnet/SSH)

The first and most important step is to get administrator rights. MI Home's regular firmware blocks access to system ports, so standard SSH input is closed. Telnet activation often requires an exploit script or exploiting a vulnerability in the data exchange protocol.

There are several ways to activate access. For older models, a method of sending a special packet of data through a data channel might work. UDP-port, while newer versions require a physical connection to contact areas on the board (UART). The choice of method depends on the revision of your device.

⚠️ Attention: Activation of Telnet on new versions of gateways may require soldering contacts. If you do not have the skills to work with a soldering iron and multimeter, it is better to choose a method of software activation or consult a specialist.

After successful activation, you will be able to connect to the device by entering it. IP-A standard login is often root, and a password can be empty or generated individually for each device based on the MAC-Once you have access to the file system, you become the full owner of the file system.

The process of installing new firmware

The process of software replacement varies depending on the type of gateway. For USB-enabled devices (such as some versions of Gateway 3), the procedure is simplified to copy the file to a flash drive. However, the classic method involves downloading an image via a web interface or command line.

If you're using the command line, you're going to have to upload a firmware file to your device, and then run the firmware command. This is a critical point that requires maximum concentration. An error in the command syntax can lead to a bootloader overwriting, which makes recovery extremely difficult.

cd /tmp


wget http://server address/firmware.bin




sysupgrade -n /tmp/firmware.bin

The table below shows the main differences in firmware methods for popular models:

💡

Successful firmware depends not so much on the image file as on the correct preparation of the environment and the choice of a method that corresponds to the revision of your device.

Networking and Integration with Home Assistant

Once you successfully install OpenWrt, you'll have a powerful network management tool. WAN and LAN So the gateway can go online and give out addresses to connected devices. IP-Gateway address is a mandatory requirement for the stable operation of a smart home.

One of the main goals of firmware reflashing is often integration with the Home Assistant platform. Xiaomi's staff hubs work through the cloud, which creates delays and dependence on the manufacturer's servers. Local firmware allows you to manage devices directly through Zigbee2MQTT protocols or native integrations.

The opkg manager is used to configure packages in OpenWrt, and the necessary dependencies are set through it. MQTT-A broker who will mediate between the gateway and your automation server, and that turns a simple hub into a full-fledged controller.

• 📡 Set up static. IP-address in the Network section → Interfaces.
• 🔌 Install the mosquitto package to work with MQTT.
• 🏠 Add the device to Home Assistant through integration MQTT.
• ⚙️ Save the configuration so that the settings don’t disappear after the reboot.

⚠️ Note: When setting up a firewall in OpenWrt, make sure that the ports for local management are closed from access from an external network (WAN). Open Telnet port or SSH Online security is a direct threat to your home.

Possible errors and ways to eliminate them

Flashing rarely goes perfectly smoothly the first time, and the most common problem is bootloop, where the device is constantly restarting without loading the operating system completely, which can happen due to image incompatibility or interruption of data recording.

If the gateway stopped responding to ping and didn’t burn with indicators (or only one light), the bootloader was likely damaged, in which case the software methods are powerless, and you would need to use the SPI programmer to physically solder the memory chip or connect via UART to boot over a u-boot.

To diagnose problems, use boot logs. UART-If you're going to see the text that comes out when you start, file system read errors or no critical modules will be explicitly indicated, which will help you find a solution in the technical documentation.

💡

Always back up the original firmware before replacing it. The saved file will allow you to return to factory condition if the alternative system does not suit you or the house is sold.

Gateway recovery after failure

If the firmware fails, don't panic if the device responds to the network connection in any way (LED flashes or appears on the list). ARP-You can try to restore it through Recovery or Failsafe mode. This often requires you to press the Reset button at a certain point after the power is turned on.

Recovery method through TFTP It's one of the most reliable devices for Qualcomm or MediaTek chips, and the idea is that when you boot it looks for a firmware file on your computer on the local network. IP on the computer and place the firmware file in the root TFTP-server.

tftp -v -m binary -c put firmware.bin 192.168.1.1

If software recovery is not possible, then the only hardware method that remains is to open the case and connect to the board. UART-You can stop the download through the console and write a clean image directly to memory, bypassing the damaged system.

• 🔌 Prepare. USB-TTL adapter (3.3B, not 5B!).
• 💻 Find the contact listing scheme (TX, RX, GND) for your model.
• ⚡ Connect the adapter and start the terminal (speed is usually 115200).
• 📥 Download the image via u-boot command tftp or loady.