Here is an example set of steps
sudo nmrpflash -v -i YOUR_ADAPTER_NAME -f R7000-V18.104.22.168_1.1.25.chk -t 10000 -T 10000 -A 10.0.0.2 -a 10.0.0.1
Right after running the command, power on your router. Your router checks for the nmrpflash server on boot. If all goes well you should see this:
sudo nmrpflash -v -i enp0s25 -f R7000-V22.214.171.124_1.1.25.chk -t 10000 -T 10000 -A 10.0.0.2 -a 10.0.0.1 Adding 10.0.0.2 to interface enp0s25. Advertising NMRP server on enp0s25 ... / Received configuration request from ab:cd:ef:12:34:56. Sending configuration: 10.0.0.1/24. Received upload request without filename. Using remote filename 'R7000-V126.96.36.199_1.1.25.chk'. Uploading R7000-V188.8.131.52_1.1.25.chk ... OK Waiting for remote to respond. Received keep-alive request (19). Remote finished. Closing connection. Reboot your device now.
Reboot the device. You now have old firwmare, congratulations.