How to rooting (get SSH access to) your Xiaomi AX9000 router:

Upon logging into the management page of the Xiaomi AX9000 router via Chrome or Edge, hit F12 to access the browser's DevTools side panel. 
Then, select the Console tab from the DevTools panel. Open create_exploit.js with a text editor. Be aware that this action may trigger a 
security warning due to the script containing router hacking code. Please disable any anti-virus software, and disregard any Windows SmartScreen 
warnings that may arise.

Once you have bypassed the warnings and blocks imposed by the security software, copy all the code from create_exploit.js and paste it into 
the Console tab's code area. Ensure your mouse cursor is positioned at the end of the pasted codes, and hit Enter. This action will let 
the browser to execute the codes. After waiting for approximately ten to several tens of seconds, this code will generate three binary files 
intended to rooting the current version of the router firmware. Upon the creation of the three .bin files, the browser will automatically 
compress them into a zip file and store it in the default download directory.

Next, extract the contents of the aforementioned zip package, then sequentially upload the files 1.bin, 2.bin, and 3.bin to the router for 
flashing via the router's manual firmware upgrade feature. Each time a file is uploaded and flashed, a "flashing failed" message may appear 
on the router's management page, and your router may undergo a restart. Please disregard these notifications and patiently wait for the router 
to reboot. After each restart, refresh the router’s management page and log back in. The router's status is indicated by the device light: 
yellow light flashing signifies ongoing setting changes, while a white light denotes a return to normal condition.

Execute the calc_passwd.js script in the browser console to obtain your telnet password. Alternatively, if you are a Pythoner, run calc_passwd.py.

After flashing the binary files, you can try telnet your router: 
telnet 192.168.31.1

When prompted for login, type root, and use the password acquired from the previous step. 

If the system rejects the password, you may need to perform a factory reset until successful connection is achieved.
If necessary, execute a factory reset via the router's webgui on the same page where you update firmware.

If you successfully telnet to your router, you can activate the SSH service by running these commands:
sed -i 's/channel=.*/channel="debug"/g' /etc/init.d/dropbear
/etc/init.d/dropbear start

After completing the above steps, open a new console window and run: 
ssh root@192.168.31.1

When prompted for a password, use the same password obtained earlier.

If SSH refused to connect, try to factory reset your router, then telnet to your router and run the dropbear related commands again.
If everything works, congratulations! You have entered a brave new world with SSH access!

--------------------------------------------------------------------------------------------------------------------------------------------------
I have included a copy of MIWIFIRepairTool, an official router repair tool from Xiaomi, as a safety precaution.

Please note that this tool will be falsely reported by some antivirus software including Microsoft Defender because it will apply for administrator 
privileges and temporarily modify local network settings. 

The password to decompress MIWIFIRepairTool.7z is: blog.kevingu.net