How I got telnet access to two Xiaomi Mi Gateway's (EU Version: ZNDMWG02LM)

[roelbroersma]

Hi,

This is just an informational message for anybody trying to open Telnet to a Xiaomi Mi Gateway (ZNDMWG02LM) and how I did it:

I have 2 gateways;

1. An Xiaomi Mi Gateway (ZNDMWG02LM) with version 1.5.6_0001 firmware, I have this gateway already for 2 years and it was probably having an older firmware when I bought it.

• I tried the php miio-cli.php --ip 192.168.x.x --token xxxxxxxxxxxxxxxxxxxxxxxxx --sendcmd '{"id":xxxxxxxxxxxx,"method":"set_ip_info","params":{"ssid":"\"\"","pswd":"123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd"}}' command without success, it said:
  PHP Deprecated: Creation of dynamic property miIO::$bind_ip is deprecated in /home/roeller/php-miio/miio.class.php on line 51
  Deprecated: Creation of dynamic property miIO::$bind_ip is deprecated in /home/roeller/php-miio/miio.class.php on line 51
  Устройство 192.168.4.60 не доступно или не отвечает.
  Note that I used it with php v8.3.11

• Then I tried the Mi Home Toolkit (windows version), logged in with my Xiaomi account, selected the gateway and clicked the 'Execute command' button. In the field method, I entered: set_ip_info and in the field params I entered: {"ssid":"\"\"","pswd":"123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd"}
  It gave me some red error in the field under it.

• Then I tried the hardware (5-2-2-2-2-2-2) method. Note that I am not sure if you have to repeat the 2 for five times or for six times (so: 5-2-2-2-2-2 or 5-2-2-2-2-2-2). The light stayed blue, but I noticed I could telnet to the device! It worked! Username: admin, password: admin

2. My second Xiaomi Mi Gateway (ZNDMWG02LM) came with firmware version: 1.5.0_0026 out of the box. I did not upgrade it!

• The manual says that I could add it by only using the token... well,. I couldn't... It said it couldn't communicate to the gateway. I got the token using the Mi Home Toolkit (windows version).
• I tried the php command as I did on my first gateway... so success.
• Then I tried the 5-2-2-2-2-2 method (with the 2's repeated 5 times and later again with 6 times). Nothing..!
• Then I tried the Mi Home Toolkit (windows version), logged in with my Xiaomi account, selected the gateway and clicked the 'Execute command' button. In the field method, I entered: set_ip_info and in the field params I entered: {"ssid":"\"\"","pswd":"123123 ; passwd -d admin ; echo enable > /sys/class/tty/tty/enable; telnetd"}
  It worked! I got an ["ok"] message back and I could now login to the device using telnet with username: admin and password: admin.

For both gateways when I could login to telnet, I cut/paste these 3 commands:
wget -O /tmp/curl "http://master.dl.sourceforge.net/project/mgl03/bin/curl?viasf=1" && chmod +x /tmp/curl

export PATH="$PATH:/tmp"

curl -s -k -L -o /tmp/update.sh https://raw.githubusercontent.com/zvldz/mgl03_fw/main/firmware/mgl03_update.sh && sh /tmp/update.sh

Then selected the modified firmware version 1.5.6 (option 9 in my case) and it download it.. installed it.. rebooted it... After the reboot I still had telnet access, when you login using telnet you could see the token AND the key. I could also add the device to Home Assistant.

These are just my 2 cents for people trying to get this working with different firmware versions using different methods. You can close this ticket :)