Do not flash a device that has AirOS firmware beyond v.5.5.10 or you will brick your device! You must first revert to version 5.5.10 and then flash OpenWrt https://community.ubnt.com/t5/airOS-SDK-Custom-Development/5-6-2-TFTP-ERROR/m-p/1307614/highlight/true#M2349. If you've already bricked your device, you may try to recover it https://community.ubnt.com/t5/airOS-SDK-Custom-Development/AirMAX-Device-Firmware-Recovery-Procedure/m-p/1499583/highlight/true#M2499.
Note that OpenWrt should work on the Bullet M2 (2GHz), but someone on the ubnt forum says it will not work on the M5 (5GHz). https://community.ubnt.com/t5/airOS-SDK-Custom-Development/Alternatives/td-p/599999
To flash an already running bullet with original firmware (AirOS) on CLI, you must do this:
ssh root@yourbullet url="http://downloads.openwrt.org/snapshots/trunk/ar71xx" url="$url/openwrt-ar71xx-generic-ubnt-bullet-m-squashfs-factory.bin" wget -O /tmp/fwupdate.bin "$url" /usr/sbin/fwupdate -m
If you prefer TFTP, than you can update via holding down the reset-button for 10 seconds on startup, and send the firmware to 192.168.1.20
See →generic.flashing or →generic.flashing.tftp for instructions.
If the bullet firmware was changed using Fon Flash using files …atheros-root.squashfs and …atheros-vmlinux.lzma the Redboot will have been changed. The result will be that the ubnt recovery method will no longer work.
To fix connect to your router using a serial cable and change the redboot to the below config.
RedBoot> fconfig -l
Run script at boot: true Boot script: .. cache off .. fis load -d -e kernel .. go Boot script timeout (1000ms resolution): 1 Use BOOTP for network configuration: false Gateway IP address: 0.0.0.0 Local IP address: 0.0.0.0 Local IP address mask: 0.0.0.0 Default server IP address: 0.0.0.0 Console baud rate: 9600 GDB connection port: 9000 Force console for special debug messages: false Network debug at boot time: false RedBoot>