Skip to content

Instantly share code, notes, and snippets.

@ukd1
Last active February 19, 2025 20:55
Show Gist options
  • Save ukd1/6020a9dc33d41183f33fa6ec853122f3 to your computer and use it in GitHub Desktop.
Save ukd1/6020a9dc33d41183f33fa6ec853122f3 to your computer and use it in GitHub Desktop.

Unifi U6 Extender - Firmware / Boot/Adoption loop fix

To add to this for anyone in the future:

  • When you reset it (long hold, lots of flashing) there will be a wifi network that's the MAC address (on the back, middle row next to the QR code).
  • Make sure you turn off auto-adopt in your console, ugh.
  • the wifi password is the last 6 of the MAC (in caps) and the 6 character code at the bottom of the text on the back of the device.
  • you can do it from a Mac by forcing it to accept older protocols: ssh -oHostKeyAlgorithms=+ssh-rsa -oPubkeyAcceptedKeyTypes=+ssh-rsa [email protected]
  • I got the firmware from here - https://community.ui.com/questions/U6-Extender-wont-update-from-6-0-15/295850ba-47b9-446e-9667-20663e4236b6

Roughly:

# disable auto adoption
# join the wifi

# grab the firmware
curl https://dl.ui.com/unifi/firmware/UAP6MP/6.2.35.14043/BZ.ipq50xx_6.2.35+14043.220812.1939.bin > u6_firmware.bin

# scp, in legacy mode, with the key stuff
scp -oHostKeyAlgorithms=+ssh-rsa -oPubkeyAcceptedKeyTypes=+ssh-rsa -O u6_firmware.bin [email protected]:

# ssh in and install it
ssh -oHostKeyAlgorithms=+ssh-rsa -oPubkeyAcceptedKeyTypes=+ssh-rsa [email protected]

U6-Extender-BZ.6.0.15# ubntbox fwupdate.real -h
Usage: fwupdate.real <command> [file [-cdkmh]]

fwupdate.real recognizes these commands:
        -c                  ckeck firmware file only (could not use with -m option)
        -d                  verbose mode
        -k                  keep running
        -m                  check firmware and write firmware to the flash
        -h                  show this usage
U6-Extender-BZ.6.0.15# ubntbox fwupdate.real -c u6_firmware.bin
U6-Extender-BZ.6.0.15# ubntbox fwupdate.real -m u6_firmware.bin
Writing 'SBL1           ' to /dev/mtd0     (SBL1           ) ...  [%100]
Writing 'QSEE           ' to /dev/mtd3     (QSEE           ) ...  [%100]
Writing 'DEVCFG         ' to /dev/mtd4     (DEVCFG         ) ...  [%100]
Writing 'u-boot         ' to /dev/mtd7     (u-boot         ) ...  [%100]
Writing 'gpt            ' to /dev/mmcblk0  (gpt            ) ...  [%100]
Writing 'kernel0        ' to /dev/mmcblk0p2(kernel1        ) ...  [%100]
WARNING: Invalid bootselection magic = 0
Done
@yenyen
Copy link

yenyen commented Nov 14, 2024

Thank you, you saved me (or, at least, you saved my U6 Extender) !

I dit it from Linux and the ssh command is working as well.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment