Do not flash a device that has AirOS firmware beyond v.5.5.10 or you will brick your device! You must first revert to version 5.5.10 and then flash OpenWrt https://community.ubnt.com/t5/airOS-SDK-Custom-Development/5-6-2-TFTP-ERROR/m-p/1307614/highlight/true#M2349. If you've already bricked your device, you may try to recover it https://community.ubnt.com/t5/airOS-SDK-Custom-Development/AirMAX-Device-Firmware-Recovery-Procedure/m-p/1499583/highlight/true#M2499.
Note that OpenWrt should work on the Bullet M2 (2GHz), but someone on the ubnt forum says it will not work on the M5 (5GHz). https://community.ubnt.com/t5/airOS-SDK-Custom-Development/Alternatives/td-p/599999
To flash an already running bullet with original firmware (AirOS) on CLI, you must do this:
ssh root@yourbullet url="http://downloads.openwrt.org/snapshots/trunk/ar71xx" url="$url/openwrt-ar71xx-generic-ubnt-bullet-m-squashfs-factory.bin" wget -O /tmp/fwupdate.bin "$url" /usr/sbin/fwupdate -m
If you prefer TFTP, than you can update via holding down the reset-button for 10 seconds on startup, and send the firmware to 192.168.1.20
See →generic.flashing or →generic.flashing.tftp for instructions.
This section must be wrong since Bullet M2 should use Uboot.
Probably this is for Bullet2 (not M2).
If the bullet firmware was changed using Fon Flash using files …atheros-root.squashfs and …atheros-vmlinux.lzma the Redboot will have been changed. The result will be that the ubnt recovery method will no longer work.
To fix connect to your router using a serial cable and change the redboot to the below config.
RedBoot> fconfig -l
Run script at boot: true Boot script: .. cache off .. fis load -d -e kernel .. go Boot script timeout (1000ms resolution): 1 Use BOOTP for network configuration: false Gateway IP address: 0.0.0.0 Local IP address: 0.0.0.0 Local IP address mask: 0.0.0.0 Default server IP address: 0.0.0.0 Console baud rate: 9600 GDB connection port: 9000 Force console for special debug messages: false Network debug at boot time: false RedBoot>