FACT

Free plan APILinuxSelf-hostedWeb

What FACT is

FACT is free, open-source software for static security analysis of firmware from routers, IoT equipment, UEFI systems, webcams, drones, and similar devices. It identifies firmware containers, unpacks nested layers, and examines software, versions, boot services, known CVEs, hard-coded credentials, cryptographic material, CPU architecture, and possible implementation flaws. Firmware images can be compared for changed or matching files and software versions. FACT stores firmware and results in a searchable database, including byte-pattern searches, and provides a browser interface plus a REST API covering almost all features. Extractors, analysis functions, and comparison tools use plugins that can be extended locally. It is self-hosted Linux software with stable installer listings for Debian 13 and Ubuntu 22.04, 24.04, and 26.04; Kali support is experimental. Minimum requirements are four CPU cores, 8 GB RAM, and 10 GB disk, with extra storage needed for results.

Who it suits

FACT suits security practitioners and researchers analyzing firmware on Linux systems. It is intended for self-hosted installations rather than public internet deployment.

What it does well

Free GPL-licensed software
Automated firmware unpacking
Static analysis identifies known CVEs
Searchable results database
REST API and plugin support

What to know first

Requires self-hosted Linux installation
Web interface is not hardened
Kali support is experimental
Dockerized version is unmaintained

Plans

Plan	Billed and limits	Price
FACT	GPL-3.0 software · self-hosted installation · requires Linux	Free

As fkie-cad.github.io lists them, read 8 Oct 2026. The maker's own page has the final word.

Verdict

FACT offers broad firmware extraction, analysis, comparison, search, and integration features at no software cost. Its research-prototype status and security cautions mean administrators must secure and operate the installation carefully.

Facts from FACT's own pages

Analysis: It identifies software, versions, boot services, known CVEs, hard-coded credentials, cryptographic material, CPU architecture, and potential implementation flaws. · fkie-cad.github.io, 8 Oct 2026
Authentication: FACT offers optional basic authentication, roles, and user management. · github.com, 8 Oct 2026
Comparison: FACT can identify changed or equal files and changed software versions between firmware images. · fkie-cad.github.io, 8 Oct 2026
Extensibility: Extractors, analysis features, and comparison functions are implemented as plugins, and additional plugins can be added to a local installation. · fkie-cad.github.io, 8 Oct 2026
Firmware extraction: FACT automates identifying firmware container formats and unpacking firmware layers. · fkie-cad.github.io, 8 Oct 2026
Integration: FACT provides a REST API covering almost all of its features. · fkie-cad.github.io, 8 Oct 2026
Interface: The product provides a browser-based interface for browsing firmware components and navigating analysis results. · github.com, 8 Oct 2026
License: FACT is free software under GPL version 3 or, at the user's option, any later version; some plugins may use different licenses. · github.com, 8 Oct 2026
Limitations: The repository describes FACT as a research prototype, and says its Dockerized version is currently unmaintained. · github.com, 8 Oct 2026
Maker and funding: FACT is developed by Fraunhofer FKIE and the FACT community, with partial funding from Germany's Federal Office for Information Security and others. · fkie-cad.github.io, 8 Oct 2026
Purpose: FACT automates firmware security analysis for devices such as routers, IoT equipment, UEFI systems, webcams, and drones. · fkie-cad.github.io, 8 Oct 2026
Requirements: The documented minimum system requirements are 4 CPU cores, 8 GB RAM, and 10 GB disk space, with additional disk space needed for extracted files and analysis results. · github.com, 8 Oct 2026
Search: FACT stores firmware files and analysis results in a searchable database that supports searching byte patterns in unpacked files. · fkie-cad.github.io, 8 Oct 2026
Security: The maintainers caution that FACT is not intended as a public internet service and that its web interface is not hardened; they recommend resetting passwords before use on networks that are not fully trusted. · github.com, 8 Oct 2026
Supported systems: The installer lists Debian 13 and Ubuntu 22.04, 24.04, and 26.04 as stable, with Kali support marked experimental. · github.com, 8 Oct 2026

Where FACT stands on Freedom251

Reverse Engineering Tools#14 of 73