Ubnt Upgrade Firmware
Margurite Vizarro
If you have a device that you've tried to set-inform from SSH, but it's not showing up for adoption in your UniFi controller, a common problem is that the device's firmware needs to be manually upgraded before it can be adopted.
Now from the SSH prompt, issue the upgrade command. Replace the firmware URL with the appropriate one for your device. The exact command will vary by model and firmware version. For the UAP AC Lite in our example, it is:
The device should reboot with the new firmware version which you can verify with the info command. Then you should be able to set-inform from there, or set-default then set-inform if you have any problems.
HostiFi provides hosting for both Ubiquiti and TP-Link software-defined-networking (SDN) applications, with servers for UniFi, UISP and Omada. We also offer professional networking consulting, with HostiFi Pro.
"They have decoupled firmware from controller version. They do bundle versions with the controller, but if the controller has Internet access and can see a newer firmware version online, it will try to upgrade them to that version which requires each EP (or switch or USG) to have Internet access to download the file itself. "
Hello, we are using Sophos UTM and UniFi APs, when I want to upgrade firmware of APs I have to create firewall rule for UniFi Cloud Key to access the internet (it's little annoying). Do you have any URL exceptions list for UniFi to download firmware etc.? Thank you.
Just go to Tools > Software Upgrade in the Elevated radios GUI and upload the Ubiquiti firmware file. After it finishes the flashing process, it will come back up just like it was before being elevated.
Upon, simply loading the UBNT firmware into the Elevate UI under the software upgrade window (as you would normally upgrade the firmware on a Cambium device), I have lost access to the device. Neither discovery tool will find it, and I cannot ping the IP at all.
It sounds like something went wrong flashing it... I've had that happen with quite a few ubnt radios recently (not just going between Elevate and ubnt firmware, but more so just updating the ubnt firmware to newer versions).
Normally the firmware of your UniFi devices is updated through the console. But sometimes we will need to update the UniFi Firmware manually. For example, when you are unable to adopt an access point.
After you have started the firmware upgrade you will lose your SSH connection. The device will update the firmware and reboot once completed. It can take a couple of minutes until the upgrade is completed.
Ubiquiti released version 1.11.0 of their firmware for the UDM late in 2021 and prior to starting back to work in anger this year I decided to upgrade. The actual firmware update went without a hitch and my internet connection was only offline for a few moments. However, I quickly discovered that I had no ability to manage any aspect of networking at all.
Not being the only person in the house, I would have been informed very quickly if there was an issue preventing internet access. After some quick tests I was able to verify that all networking and routing was working fine, it was just that I couldn't access the "Network" application to manage anything.
For those not familiar with the UDM-PRO, it's a rack mountable router that also manages other parts of the UniFi ecosystem (for example telephony, cameras etc). I only currently have it managing my network but it manages everything from WiFi to my homelab.
Each different use has a separate application that is used to manage and operate that function. As you can see in the screenshot above, I have only "Network" enabled. After the firmware update this was showing as Starting. The version was also showing as 6.5.54, which may have been related to the issue.
A restart of the UDM didn't address the issue so I opted to have a poke around the CLI to see if there was any further information. Fortunately I already had SSH enabled so getting in wasn't a problem.
I tried looking through the service's log files but couldn't really see what was going on. I did know however that version 6.5.55 of the Network application was available, I thought it might be worth trying to update it, which you can't do through the UI when it's not running. The following commands will do that:
According to Ubiquiti documentation, the new templated operational command add system image can be used to update the firmware of the router through the command line interface (CLI). A templated operational command allows the user to quickly modify the operational state of the router without fiddling with complex command-line parameters. This simplifies the process for day-to-day operations and minimizes user errors. I am sure we have all heard of horror stories of system administrators who accidentally deleted critical files, locked themselves out of equipment that is far away from civilization, and so forth. Templated commands attempt to mitigate these issues.
The templating system used by the Ubiquiti EdgeRouter is provided by the vyatta-op package. The command add system image is defined in the /opt/vyatta/share/vyatta-op/templates/add/system/image/node.def file.
By running this operational command, the user is effectively invoking the ubnt-fw-latest script with the --upgrade option. This option causes the ubnt-fw-latest script to run the upgrade_firmware() function, which will check with a Ubiquiti update server to get information about the latest firmware release, including the firmware download URLs.
The function proceeds to parse and compare the results from the server with the current firmware version. If an update is available, the script will invoke ubnt-upgrade to fetch the firmware from the fw-download.ubnt.com domain provided by the upgrade server. It will then perform the actual firmware upgrade.
Since /usr/sbin/ubnt-upgrade does not check for the validity of the certificate, an attacker can use a self-signed certificate to spoof the fw-download.ubnt.com domain without triggering any warnings or complaints on the device to alert the user. This vulnerability significantly reduces the skill barrier needed to launch a successful attack.
To exploit this vulnerability, the attacker can modify an existing EdgeRouter firmware image and fix up the checksum contained in the file. In the submitted proof-of-concept, the researcher modified the rc.local file to connect back to the attacker with a reverse shell. A reboot is part of the upgrade process, triggering the rc.local script.
Just a quick post today to show you how update the firmware on your Ubiquiti Cloud Key G2 via SSH. I recently had to do this after an update created the dreaded "UniFi is having trouble with this direction..." within the web GUI so I needed to downgrade the firmware to make it functional again.
In my case we upgrade to the latest firmware 2.1.11 from 2.0.27. Why this happened I'm unsure as are alot of disgruntled Ubiquiti admins and you can read about that here... Before starting any of the following procedure, ensure you have a current backup of your device download to your PC in case something goes wrong.
First, go the Ubiquiti download site here... and find the firmware you wish to upgrade or downgrade to and click the download link and select "Copy URL" from the pop screen like the following example:
The device will automatically reboot once the firmware update procedure is complete. Sadly, this didn't rectify my problem and in actual fact, made the situation worse because the web GUI wouldn't come up at all now.
The device will reboot and you will need to go through the initial setup procedure when you access the web GUI. You can log on and configure your device and then restore from your backup that you created earlier.
Your Hubox Unifi Controller makes it easy to upgrade your device firmware. In most cases, a couple of clicks are all that's required. However, in some very rare cases, you may need to 'rescue' a failed upgrade with a manual upgrade via your controller GUI, or in very rare cases, via command line into the device.
If the 'Always show actions' box is checked, you will always see devices with upgrades available. Clicking upgrade will have obvious results i.e. the device will become unavailable for five or ten minutes while it downloads firmware and goes through the process of installing it. DO NOT power off the device during this action, you could brick it, and only do this during your maintenance window so that minimum disruption is caused.
In some cases it may be necessary to provide the controller with a specific firmware version. Maybe you have clicked upgrade and don't like the results, so you want to downgrade to a previous firmware. This is pretty straightforward, you can download specific firmware versions for each device from the Ubiquiti website and then upload it to the device via the Hubox GUI, like so. . . again, the relevant parts are highlighted in red. . .
. . . click the gear icon for the device management settings, and simply give the controller the URL of the desired firmware, click 'Custom Upgrade' and the desired firmware will be installed to the device. Job done.
There may be times when the only way to upgrade is via SSH. This is usually a last resort and for emergencies only. There may also be times when you have been shipped a device with very old firmware (been sitting in a warehouse for years) and the controller cannot or will not adopt it until the firmware have been updated.
Once again, the desired firmware can be located on the Ubiquiti website (usually you will select the latest version). Copy the URL of the firmware to your clipboard, or paste it to a notepad for the following steps. . .
Identify the device IP address in question on your network and connect to it with your favorite SSH client. Windows users will be using PuTTY. Linux users will use the terminal client present in all Linux distributions. The example below uses PuTTY. . .
Note that if none of the above methods are working for you, this takes us into advanced device recovery territory using TFTP and Console recovery methods, which are beyond the scope of this article. We will write another set of instructions for that.
c80f0f1006