Xiaomi Mi Router AIoT AC2350 (R2350)

multiple revisions of this device, use caution
abgn+ac (AC22002R)
	AC2200 Wireless Gigabit Router; Xiaomi Mi Router AIoT AC2350 (R2350)
Homepage	Product page
3rd Party Firmware
dd-wrt	Status Unknown
OpenWrt	Partial Support
Tomato any flavor	Incompatible
Gargoyle	Status Unknown
Platform
Brand • Model • Rev	Xiaomi Mi Router AIoT AC2350 (R2350)
Serial number prefix	M64
FCC ID	none specified
Board ID	DVB4248GL
Type	wireless router
CPU1	Qualcomm Atheros QCA9563
CPU1 Type	MIPS 74Kc
CPU1 Speed	775 MHz
Flash1 Chip	cFeon EN25QH128
Flash1 Size	16 MiB 16,777,216 B <br />131,072 Kib <br />16,384 KiB <br />128 Mib <br />0.0156 GiB <br /> (SPI NOR)
RAM1 Size	128 MiB 134,217,728 B <br />1,048,576 Kib <br />131,072 KiB <br />1,024 Mib <br />0.125 GiB <br /> (DDR2)
RAM1 Chip	EtronTech EM68C16CWQG-25H
ETH chip1	Qualcomm Atheros QCA9563
Switch	Qualcomm Atheros QCA8337N
Ethernet Port Count	1-1GbE-WAN; 3-1GbE-LAN
Wired Standard	IEEE 802.3i/3u/3ab
	802dot11 OUI: none specified;
Stock bootloader	U-Boot
Expansion IF types	USB 2.0
USB ports	2
USB Hub Compatible	Untested
Power	12 VDC, 1.5 A
Connector type	barrel
Serial Port (UART)	yes, 3.3V TTL, (115200 8N1)
	Additional chips; AIoT 802.11abgn 1×1 Wi-Fi Chip;Qualcomm Atheros;QCA6006X;QCA6006X-AL3A;1;
Other
3rd Party Firmware Support	OpenWrt • (List \| Dev \| DLs);
Retail
(Est.) release date	March 2020
Country of manuf	China
Radio 1
Chip1	Qualcomm Atheros QCA9563
Wireless interface OUI	none specified
Antenna Connector Type	none specified
MIMO status	3x3:3
Wireless Standard	IEEE 802.11b/g/n
802.11n	up to 450 Mbps
802.11g	up to 54 Mbps
802.11b	up to 11 Mbps
WiFi Operating Frequency	2.4 GHz
Radio 2
Chip1	Qualcomm Atheros QCA9988
Wireless interface OUI	none specified
Antenna Connector Type	none specified
MIMO status	4x4:4
Wireless Standard	IEEE 802.11a/n/ac
802.11ac	up to 1733 Mbps
802.11n	up to 600 Mbps
802.11a	up to 54 Mbps
WiFi Operating Frequency	5 GHz

For a list of all currently documented Qualcomm Atheros (QCA) chipsets with specifications, see Qualcomm Atheros.

For a list of all currently documented Xiaomi devices with specifications, see Xiaomi.

• 450 Mbps - 3SS 2.4GHz 802.11n (40MHz chan.),

• 1733 Mbps - 4SS 5GHz 802.11ac (80MHz chan.) = AC2200 class

Links of Interest

Xiaomi Mi Router AIoT AC2350 on AC|WiFi (CN)

PCB: M64 (R0106, 2020/03/25)

Xiaomi Mi Router AIoT AC2350 on 4PDA (RU)

Model: R2350 (DVB4248GL)

Flashing

NOTE: During configuration or flashing a device, the only things that should be hooked to the device is the computer and power.

Flashing OpenWrt

On the OpenWrt ToH (techdata entry)
On the OpenWrt Wiki
On the OpenWrt Forum

Target: ath79
Subtarget: generic
Package architecture: mips_24kc
[Xiaomi AIoT Router AC2350 Supported Since Commit]
Support started version: 21.02.2
Current supported version: 25.12.0

Unsupported Functions:
USB IoT radio
LAN Hardware: Qualcomm QCA8337N
LAN Comment: 1x WAN, 3x LAN
WLAN Hardware: Qualcomm Atheros QCA9563, Qualcomm Atheros QCA9988
WLAN Comment: MIMO 3x3:3 2.4Ghz, MIMO 4x4:4 5Ghz
Installation method(s):
see devicepage, see git-commit
Install Comment:
Using exploit on stock firmware
Recovery method(s):
TFTP generic, Serial, U-Boot TFTP + serial recovery, see devicepage, see git-commit
Recovery Comment:
Only stock firmware can be used for recovery
Comment:
Internally connected Qualcomm Atheros QCA6006 USB IoT radio

git • >>

ath79: add support for Xiaomi AIoT Router AC2350
Device specifications
* SoC: QCA9563 @ 775MHz (MIPS 74Kc)
* RAM: 128MiB DDR2
* Flash: 16MiB SPI-NOR (EN25QH128)
* Wireless 2.4GHz (SoC): b/g/n, 3x3
* Wireless 5Ghz (QCA9988): a/n/ac, 4x4 MU-MIMO
* IoT Wireless 2.4GHz (QCA6006): currently unusable
* Ethernet (AR8327): 3 LAN × 1GbE, 1 WAN × 1GbE
* LEDs: Internet (blue/orange), System (blue/orange)
* Buttons: Reset
* UART: through-hole on PCB ([VCC 3.3v](RX)(GND)(TX) 115200, 8n1)
* Power: 12VDC, 1,5A

MAC addresses map (like in OEM firmware)
  art@0x0     88:C3:97:*:57  wan/label
  art@0x1002  88:C3:97:*:2D  lan/wlan2g
  art@0x5006  88:C3:97:*:2C  wlan5g

Obtain SSH Access
1. Download and flash the firmware version 1.3.8 (China).
2. Login to the router web interface and get the value of `stok=` from the
   URL
3. Open a new tab and go to the following URL (replace <STOK> with the stok
   value gained above; line breaks are only for easier handling, please put
   together all four lines into a single URL without any spaces):
     http://192.168.31.1/cgi-bin/luci/;stok=<STOK>/api/misystem/set_config_iotdev
       ?bssid=any&user_id=any&ssid=-h%0Anvram%20set%20ssh_en%3D1%0Anvram%20commit
       %0Ased%20-i%20%27s%2Fchannel%3D.%2A%2Fchannel%3D%5C%5C%22debug%5C%5C%22%2F
       g%27%20%2Fetc%2Finit.d%2Fdropbear%0A%2Fetc%2Finit.d%2Fdropbear%20start%0A
4. Wait 30-60 seconds (this is the time required to generate keys for the
   SSH server on the router).

Create Full Backup
1. Obtain SSH Access.
2. Create backup of all flash (on router):
    dd if=/dev/mtd0 of=/tmp/ALL.backup
3. Copy backup to PC (on PC):
    scp root@192.168.31.1:/tmp/ALL.backup ./
Tip: backup of the original firmware, taken three times, increases the
chances of recovery :)

Calculate The Password
* Locally using shell (replace "12345/E0QM98765" with your router's serial
  number):
  On Linux
    printf "%s6d2df50a-250f-4a30-a5e6-d44fb0960aa0" "12345/E0QM98765" | \
    md5sum - | head -c8 && echo
  On macOS
    printf "%s6d2df50a-250f-4a30-a5e6-d44fb0960aa0" "12345/E0QM98765" | \
    md5 | head -c8
* Locally using python script (replace "12345/E0QM98765" with your
  router's serial number):
    wget https://raw.githubusercontent.com/eisaev/ax3600-files/master/scripts/calc_passwd.py
    python3.7 -c 'from calc_passwd import calc_passwd; print(calc_passwd("12345/E0QM98765"))'
* Online
    https://www.oxygen7.cn/miwifi/

Debricking (lite)
If you have a healthy bootloader, you can use recovery via TFTP using
programs like TinyPXE on Windows or dnsmasq on Linux. To switch the router
to TFTP recovery mode, hold down the reset button, connect the power
supply, and release the button after about 10 seconds. The router must be
connected directly to the PC via the LAN port.

Debricking
You will need a full dump of your flash, a CH341 programmer, and a clip
for in-circuit programming.

Install OpenWRT
1. Obtain SSH Access.
2. Create script (on router):
    echo '#!/bin/sh' > /tmp/flash_fw.sh
    echo >> /tmp/flash_fw.sh
    echo '. /bin/boardupgrade.sh' >> /tmp/flash_fw.sh
    echo >> /tmp/flash_fw.sh
    echo 'board_prepare_upgrade' >> /tmp/flash_fw.sh
    echo 'mtd erase rootfs_data' >> /tmp/flash_fw.sh
    echo 'mtd write /tmp/openwrt.bin firmware' >> /tmp/flash_fw.sh
    echo 'sleep 3' >> /tmp/flash_fw.sh
    echo 'reboot' >> /tmp/flash_fw.sh
    echo >> /tmp/flash_fw.sh
    chmod +x /tmp/flash_fw.sh
3. Copy `openwrt-ath79-generic-xiaomi_aiot-ac2350-squashfs-sysupgrade.bin`
   to the router (on PC):
    scp openwrt-ath79-generic-xiaomi_aiot-ac2350-squashfs-sysupgrade.bin \
    root@192.168.31.1:/tmp/openwrt.bin
4. Flash OpenWRT (on router):
    /bin/ash /tmp/flash_fw.sh &
5. SSH connection will be interrupted - this is normal.
6. Wait for the indicator to turn blue.

Pictures

Retail Images

Xiaomi Mi Router AIoT AC2350 (R2350)

Links of Interest

Flashing

Flashing OpenWrt

Pictures

See also

Navigation menu

Page actions

Page actions

Personal tools

empty section

Search

Navigation

data/misc

Tools

query forms

Shoutwiki

ShoutWiki messages