# "Rescuing a UniFi Cloud Key Gen2 Plus"
  by Colin Cogle

Published Monday, October 17, 2022.


## Abstract
A non-working eBay item gets saved from the scrap heap, and I get a cheap upgrade.

## Introduction
When I found a non-working UniFi Cloud Key Gen2 Plus on eBay for 99 cents, I decided, "why not?"  (This was before I heard that [UniFi Network App 7.3 will drop support for the now-vintage first-generation Cloud Key](https://community.ui.com/releases/UniFi-Network-Application-7-3-69/d801e00a-8d7d-4e52-b6db-d4d8d87835fb).)

The Cloud Key Gen2 would be sitting inside a closet, so I wasn't too concerned that this thing had been physically damaged, cracked and dented, and sold without the internal hard drive.  Fortunately, it arrived and looked better than I expected.

![My new-to-me UniFi Cloud Key Gen2 Plus.](http://colincogle.name/blog/unifi-cloud-key-rescue/UCK-1.jpg "My damaged and unbootable UniFi Cloud Key Gen2 Plus.  It looks fine from this angle, but there is cosmetic damage around the rear USB-C power port.")

## Disassembly
To start, remove the back plastic.  It's glued on, so use a spudger or guitar pick to break the adhesive.  Once you've gotten that off, there are seven Phillips-head screws underneath to remove.

![Removing the back plastic of the UniFi Cloud Key Gen2 Plus.](http://colincogle.name/blog/unifi-cloud-key-rescue/UCK-2.jpg)
![The UniFi Cloud Key Gen2 Plus once the back plastic has been removed.](http://colincogle.name/blog/unifi-cloud-key-rescue/UCK-3.jpg "Note the screws to be removed.")

To continue disassembly,  we will need to remove the hard drive and the latch itself.  Slide the latch over to remove the hard drive and the tray.  Then, use the end of a flat-head screwdriver or metal spudger, gently press on one of the tabs to pop it loose.  Hold the metal slider in position, then carefully remove the plastic tab.

![The hard drive bay and latching mechanism inside a UniFi Cloud Key Gen2 Plus.](http://colincogle.name/blog/unifi-cloud-key-rescue/UCK-4.jpg "I'm sure there's a better tool to use to remove this thing.")
![The hard drive latch removed from a UniFi Cloud Key Gen2 Plus.](http://colincogle.name/blog/unifi-cloud-key-rescue/UCK-5.jpg "Gently push the latch's tabs to pop it free.  Be careful not to break it.")

Now, we need to remove two screws underneath the screen.  The screen is held on by adhesive, like everything else these days.  Use a spudger or plastic opening tool to carefully pry it up.  Note that there is an unremovable ribbon cable on the bottom edge. Take care not to sever it. (Ubiquiti does not sell spare parts.  I've tried.)

![Breaking the screen adhesive on a UniFi Cloud Key Gen2 Plus.](http://colincogle.name/blog/unifi-cloud-key-rescue/UCK-6.jpg "The display is glued on.  Carefully break the adhesive.")
![The display ribbon cable of a UniFi Cloud Key Gen2 Plus.](http://colincogle.name/blog/unifi-cloud-key-rescue/UCK-7.jpg "However, be careful not to break the display cable along the bottom edge.")

Next, the 13-pin connector for the Cloud Key Gen2 Rack Mount Accessory needs to be removed.   There are four latches on the underside to make sure that it sits flush.  This also means that removing it is next to impossible.  You can try to carefully pry it up, but I had luck pushing it up from underneath.   If you try that, be sure to push up on the plastic, and not on the wires themselves!

Once you have all four tabs disengaged, unplug the connector.  Be sure to mark it, or remember which way it goes so you can reassemble it later.

![Removing the 13-pin rackmount port from the UniFi Cloud Key Gen2 Plus.](http://colincogle.name/blog/unifi-cloud-key-rescue/UCK-8.jpg)

Finally, the entire plastic unit can be slid out of the aluminum housing.  Normally, this will not be a problem.  However, these batteries do seem to be defective, because they tend to swell up and fail, so I hear -- and now, so I see firsthand.

![The internal battery in a UniFi Cloud Key Gen2 Plus.](http://colincogle.name/blog/unifi-cloud-key-rescue/UCK-9.jpg "This battery has swollen and failed.")

If your battery is bad, let's grab a plastic, non-conductive tool and gently break the adhesive holding it to the plastic tray.

**Warning: Piercing a battery can cause an electric shock or start a fire, causing injury or death. Be careful!**

Ubiquiti does not sell replacement batteries, instead asking you to spend $200 on a new Cloud Key. They also refused to issue an RMA for this spicy pillow, so into the e-waste bin this little fire hazard goes.   [Ubiquiti gave up on trying to fix the problem, instead removing the battery entirely from the latest revision of the Cloud Key Gen2 Plus.](https://community.ui.com/questions/Could-Key-Gen-2-Battery-DOA/7ccd440a-761f-40c4-8aea-1275f235639c#answer/8cbd5ae6-dca8-4235-8a09-84b78874f40d)

![The internal battery from a UniFi Cloud Key Gen2 Plus.](http://colincogle.name/blog/unifi-cloud-key-rescue/UCK-10.jpg "This battery has swollen and failed.")

The Cloud Key is now fully disassembled. If you were reading this to remove the battery, congratulations!  You're done.  Reverse these steps to put this back together (hopefully with a working battery).


## Unflashable Firmware?
In my case, this Cloud Key wouldn't boot.   I booted it up in recovery mode and attempted to re-flash the firmware, but it refused to accept any firmware image; it refused to accept an image of the same version, 2.0.27, but it also refused to accept newer and older versions, too.

Since I already had this thing apart, I hooked up my 3.3V TTL serial adapter to the three-pin header located at port J22.

![The internal serial port (J22, circled) inside the UniFi Cloud Key Gen2 Plus.](http://colincogle.name/blog/unifi-cloud-key-rescue/UCK-11.jpg "Header J22 is a 3.3V TTL serial port. The other one seems to be, too, but I haven't figured out what that might be for.")

After getting the pinout right, I was greeted with a serial console!

```
Please press Enter to activate this console. 

Boottime: 4.52s

cloudkey-apq8053 login: ubnt
Password: 
Login incorrect
cloudkey-apq8053 login: root
Password: 
				.--.__
	______ __ .--(    ) )-.   __ __
	|      |  (._____.__.___)_|  |  |__ _____ __ __
	|   ---|  ||  _  |  |  |  _  |    <|  -__|  |  |
	|______|__||_____|_____|_____|__|__|_____|___  |
		(c) 2018 Ubiquiti Networks, Inc.  |_____|

		Welcome to the CloudKey Recovery!
```

Fortunately, [the default usernames and password are well-known](https://help.ui.com/hc/en-us/articles/204909374-UniFi-Login-with-SSH-Advanced-).  Once I logged in, I began to browse the recovery filesystem.  I checked [the boot messages and `dmesg` output](http://colincogle.name/blog/unifi-cloud-key-rescue/UCK-G2-PLUS%20boot%20messages%20v2.0.27.txt), but found nothing of interest.

However, I found an app in the filesystem called `ubnt-tool`,  which has a mode called `fwupdate`.  I figured it'd be worth a shot.  I grabbed the URL of [the latest firmware blob](https://www.ui.com/download/unifi/unifi-cloud-key-gen2/uck-g2-plus), downloaded it to the device, and installed it.

```console
cloudkey-apq8053# cd /tmp
cloudkey-apq8053# wget https://fw-download.ubnt.com/data/unifi-cloudkey/6fac-UCKP-2.5.11-c5a57cf5d5344114a762782ab4d3a940.bin
cloudkey-apq8053# ubnt-tool fwupdate 6fac-UCKP-2.5.11-c5a57cf5d5344114a762782ab4d3a940.bin
```

There were a lot of unchanged blocks for being so many years behind on firmware updates, but one `reboot` later, my Cloud Key was back up and running!

===================================
["Rescuing a UniFi Cloud Key Gen2 Plus" by Colin Cogle](http://colincogle.name/uck) is published under a [Creative Commons Attribution-ShareAlike 4.0 International (CC-BY-SA)](https://creativecommons.org/licenses/by-sa/4.0/) license.