template_device

To flash an already running bullet with original firmware (AirOS) on CLI, you must do this:

ssh root@yourbullet
url="http://downloads.openwrt.org/snapshots/trunk/ar71xx"
url="$url/openwrt-ar71xx-generic-ubnt-bullet-m-squashfs-factory.bin"

wget -O /tmp/fwupdate.bin "$url"
/usr/sbin/fwupdate -m

If you prefer TFTP, than you can update via holding down the reset-button for 10 seconds on startup, and send the firmware to 192.168.1.20
See →generic.flashing or →generic.flashing.tftp for instructions.

http://wiki.ubnt.com/Firmware_Recovery

If the bullet firmware was changed using Fon Flash using files …atheros-root.squashfs and …atheros-vmlinux.lzma the Redboot will have been changed. The result will be that the ubnt recovery method will no longer work.

To fix connect to your router using a serial cable and change the redboot to the below config.

RedBoot> fconfig -l

Run script at boot: true
Boot script:
.. cache off
.. fis load -d -e kernel
.. go

Boot script timeout (1000ms resolution): 1
Use BOOTP for network configuration: false
Gateway IP address: 0.0.0.0
Local IP address: 0.0.0.0
Local IP address mask: 0.0.0.0
Default server IP address: 0.0.0.0
Console baud rate: 9600
GDB connection port: 9000
Force console for special debug messages: false
Network debug at boot time: false
RedBoot>