下载并安装降级固件
AX3600 AX1800 AX5 AC2100 红米AX6000
开启SSH权限
登陆路由器管理界面，点击路由状态页签，此时地址栏应该显示如下地址：
http://miwifi.com/cgi-bin/luci/;stok=xxxxxxx/web/home#router
将/web/home#router替换为如下文本，之后输入回车访问，此时页面返回{“code”:0}，即可使用ssh工具测试是否开启成功。（注意不要使用mac或iOS自带的safari浏览器）
/api/misystem/set_config_iotdev?bssid=Xiaomi&user_id=longdike&ssid=-h%3B%20nvram%20set%20ssh_en%3D1%3B%20nvram%20commit%3B%20sed%20-i%20's%2Fchannel%3D.*%2Fchannel%3D%5C%22debug%5C%22%2Fg'%20%2Fetc%2Finit.d%2Fdropbear%3B%20%2Fetc%2Finit.d%2Fdropbear%20start%3B%20echo%20-e%20'admin%5Cnadmin'%20%7C%20passwd%20root%3B固化SSH权限
登陆SSH（用户root，密码admin）
echo -e 'admin\nadmin' | passwd root
nvram <span class="hljs-keyword">set</span> ssh_en=<span class="hljs-number">1</span>
nvram <span class="hljs-keyword">set</span> telnet_en=<span class="hljs-number">1</span>
nvram <span class="hljs-keyword">set</span> uart_en=<span class="hljs-number">1</span>
nvram <span class="hljs-keyword">set</span> boot_wait=<span class="hljs-keyword">on</span>
nvram <span class="hljs-keyword">commit</span> sed -i <span class="hljs-string">'s/channel=.*/channel="debug"/g'</span> /etc/init.d/dropbear /etc/init.d/dropbear restart
mkdir /<span class="hljs-keyword">data</span>/auto_ssh
cd /<span class="hljs-keyword">data</span>/auto_ssh
curl -O https://fastly.jsdelivr.net/gh/lemoeo/AX6S@<span class="hljs-keyword">main</span>/auto_ssh.sh chmod +x auto_ssh.sh
uci <span class="hljs-keyword">set</span> firewall.auto_ssh=<span class="hljs-keyword">include</span> uci <span class="hljs-keyword">set</span> firewall.auto_ssh.type=<span class="hljs-string">'script'</span>
uci <span class="hljs-keyword">set</span> firewall.auto_ssh.path=<span class="hljs-string">'/data/auto_ssh/auto_ssh.sh'</span>
uci <span class="hljs-keyword">set</span> firewall.auto_ssh.enabled=<span class="hljs-string">'1'</span>
uci <span class="hljs-keyword">commit </span>firewall
uci <span class="hljs-keyword">set</span> system.@<span class="hljs-keyword">system</span>[<span class="hljs-number">0</span>].timezone=<span class="hljs-string">'CST-8'</span>
uci <span class="hljs-keyword">set</span> system.@<span class="hljs-keyword">system</span>[<span class="hljs-number">0</span>].webtimezone=<span class="hljs-string">'CST-8'</span>
uci <span class="hljs-keyword">set</span> system.@<span class="hljs-keyword">system</span>[<span class="hljs-number">0</span>].timezoneindex=<span class="hljs-string">'2.84'</span>
uci <span class="hljs-keyword">commit</span>
mtd erase crash
reboot