The complete guide to PBX security

What a PBX is, and why it is a target

A PBX routes calls inside an organisation and connects them to the outside world. Historically this ran over ISDN lines; today most systems are software running on standard servers, connected to carriers over SIP trunks and reachable across IP networks. That shift brings the flexibility of IP telephony together with the exposure of any networked application.

Attackers value a PBX for three distinct reasons. It can be made to place chargeable calls that turn directly into revenue for the attacker. It holds call detail records, voicemail and directory information that can be sensitive in their own right. And, because it lives on your network, a compromised PBX can serve as a quiet foothold into systems that have nothing to do with telephony.

External exposure and the attack surface

The single most consequential decision in PBX security is how much of the system is reachable from the public internet. Many compromises begin not with a clever exploit but with a service that should never have been exposed being left open to the world.

Common exposure points to review defensively include:

• SIP signalling reachable from any source rather than restricted to known carriers
• Web administration consoles published to the internet without source restriction
• Provisioning and file-transfer services left open to fetch device configuration
• Voicemail, conferencing and remote-access features reachable externally
• Legacy protocols and demo features enabled by default on a fresh install

The guiding principle is to reduce the surface to the minimum the business genuinely needs. Placing the PBX behind a session border controller or a properly configured firewall, and restricting inbound signalling to your carriers, removes the majority of opportunistic exposure before any authentication is even tested.

Authentication and default credentials

Once a service is reachable, the strength of its authentication decides whether exposure becomes compromise. Weak or default credentials remain one of the most reliable ways into a phone system, precisely because they are so easy to overlook during a busy deployment.

• Administrative accounts still using the vendor's default password
• Extension secrets that match or trivially relate to the extension number
• No account lockout or rate limiting on registration attempts
• Shared administrator accounts with no way to attribute actions
• Registration secrets reused across many extensions

Management interfaces and administrative access

Beyond the calling function, a PBX exposes a set of management surfaces: web consoles, SSH, management APIs such as the Asterisk Manager Interface, and provisioning services. These are powerful by design, and an attacker who reaches them can reconfigure routing, read recordings or disable logging.

• Restricting consoles and APIs to a management network or VPN rather than the open internet
• Requiring multi-factor authentication where the platform supports it
• Using unique, named accounts so every administrative action is attributable
• Disabling management interfaces that are not in active use
• Recording administrative actions in logs that administrators cannot silently alter

Management interfaces deserve the same scrutiny as any privileged system. If a console does not need to be public, it should not be public, and that decision should be verified rather than assumed.

Dial-plan design and least privilege

The dial-plan governs which numbers each user or device is permitted to call. A permissive dial-plan is what turns a compromised extension into a large bill, because it lets the attacker route calls to expensive international and premium-rate destinations. Least privilege applied to calling is one of the highest-value controls available.

• Restricting international and premium-rate calling to the roles that genuinely need it
• Applying class-of-service so each extension can only reach permitted destinations
• Limiting or blocking calls outside normal business hours where appropriate
• Removing call-forwarding to external numbers where the business has no need for it
• Deleting unused routes, trunks and features rather than leaving them dormant

Patching and vulnerability management

PBX platforms are software, and software carries vulnerabilities. Keeping the system current is not optional maintenance; it is a front-line control, because publicly disclosed flaws are researched and reused quickly once they are known.

CVE-2025-57819 illustrates the stakes. It is an unauthenticated flaw in FreePBX that allows remote code execution, rated CVSS 10.0, and it has been added to the CISA Known Exploited Vulnerabilities catalogue. A flaw of that severity means an exposed, unpatched system could be taken over without any credentials at all, which is why prompt patching and minimal exposure matter so much together.

• Maintain an inventory of PBX components and their exact versions
• Track vendor advisories and the CISA KEV catalogue for products you run
• Test and apply security updates promptly under change control
• Prioritise anything affecting internet-facing or authentication components
• Plan the retirement of platforms that are no longer supported

Patching works best alongside exposure reduction. Reducing what is reachable buys time between a disclosure and a patch, and an up-to-date system limits what an attacker can do if they reach it.

Encryption in transit: TLS and SRTP

By default, a good deal of telephony signalling and media can traverse a network unencrypted. That leaves call setup and the audio itself open to interception on any path an attacker can observe, which is a confidentiality risk as much as a fraud risk.

• TLS to protect SIP signalling, so registration and call-control messages are encrypted and authenticated
• SRTP to protect the media stream, so the audio of a call cannot be trivially reconstructed by an eavesdropper
• Current cipher suites and valid certificates, checked rather than assumed
• Consistent application across extensions and trunks, not just a subset

Logging, review and anomaly detection

Prevention reduces the chance of compromise; logging and review shorten the time to notice one. Toll fraud in particular often runs at night or over a weekend, and the difference between a small incident and a large bill is frequently how quickly the unusual pattern is spotted.

• Retaining call detail records and reviewing them for unexpected destinations, volumes or timing
• Recording registration failures and administrative changes
• Alerting on sudden spikes in call cost, international traffic or out-of-hours activity
• Protecting logs so they cannot be quietly deleted by an intruder
• Rehearsing who responds, and how, when an alert fires

It is worth being clear about scope. Logging and periodic review are internal operational controls that you run. An assessment tells you whether the controls are present and working; it is not the same as running a round-the-clock monitoring team.

Assessment, the NCSC baseline and ongoing assurance

The controls above are only as good as their real-world implementation, which is why an authorised, independent assessment is valuable. It replaces the belief that the phone system is secure with evidence about where it actually stands, and it does so under a signed scope so that testing stays lawful and in bounds.

The NCSC's PBX best-practice guidance provides a sound baseline for UK organisations, covering exposure, authentication, configuration and monitoring. A good assessment measures your estate against that baseline and reports findings by severity, with clear remediation and a retest to confirm each issue is genuinely closed.

• A defined, signed scope naming the systems in bounds and the testing window
• Assessment of external exposure, authentication, management access and dial-plan design
• Findings ranked by severity with plain remediation guidance
• A retest to verify fixes, followed by scheduled reassessment as the estate changes