shouldiuse.io

VERDICT

Should I use 3CX?

Skip to content - 3cx.com

Depends. Buy only if you have IT staff to run and patch a VoIP PBX and want cheap simultaneous-call pricing. Skip it if you need vendor hand-holding, plug-and-play setup, or have a low security risk tolerance.

Confidence

Medium. Based on 20+ public sources including Reddit, Wired, MITRE, G2, and 3CX's own site. Review snippets were truncated in the source feed.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support quality
  • Security posture

Pricing

Free

StartUp (Free)

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
ProPer simultaneous call — see pricelist
EnterprisePer simultaneous call — see pricelist

Best for

  • Cost-conscious SMBs with in-house IT
  • MSPs managing phone systems for clients
  • Teams replacing legacy Avaya-style PBXs
  • Self-hosters wanting SIP control

Not for

  • Orgs with no security staff to patch fast
  • Buyers needing reliable vendor support
  • Non-technical teams wanting plug-and-play phones
  • Security-sensitive orgs post-supply-chain-attack

Gotchas - check before you buy

high

Licensed per simultaneous call, not per user — misestimate and calls block or you overpay

high

Self-hosted installs need prompt patching; 3CX publishes recurring security alerts

medium

Pricing changed again January 2026; budget for surprise increases

medium

Support complaints recur; users publish 'moving away from 3CX' threads

Pros and cons

Pros

  • Cuts telco costs vs legacy PBXs per case studies
  • 350,000+ businesses and 12M users claimed
  • Aggressive, frequent product development
  • Reviewers praise an easy-to-use interface
  • Free StartUp tier; cloud or on-premise deployment

Cons

  • 2023 nation-state supply-chain attack hit its signed desktop app
  • Users report poor vendor support
  • Frequent security alerts; self-hosters must patch fast
  • Complex simultaneous-call licensing confuses buyers
  • Reddit threads titled 'Stay away' and 'Moving away'

Sources & method

Analyzed 9/27/2026 - 12 sources - Signed desktop app compromised in a 2023 nation-state supply-chain attack; repeated CVEs and exposure alerts since.

official x3review x5security x3news x1
  • 2023 double supply-chain attack, Two linked compromises pushed trojanized desktop app updates; MITRE tracks it as campaign C0057.
  • CVE-2023-49954, SQL injection vulnerability in 3CX CRM integration.
  • Local privilege escalation (Aug 2024), Reported by Praetorian in 3CX Phone System.
  • Recurring exposure alerts, June 2026 hotfix required for self-hosted deployments; publicly exposed instances flagged.

Key stats

  • Value for money: 4/5

    Rating

  • Free

    Starting price

  • 12

    Sources

  • Analyzed

  • Value for money: 4/5. Cheap vs legacy PBX; pricing shifts annoy
  • Ease of use: 4/5. Reviewers call the interface easy
  • Feature depth: 4/5. Full UC suite, aggressive development pace
  • Support quality: 2/5. Users report poor vendor support
  • Security posture: 1/5. 2023 nation-state supply-chain attack; ongoing alerts
  • 350,000+ Businesses on 3CX 12M users claimed
  • 548 G2 reviews mixed sentiment
  • Yes Free tier StartUp free plan
  • Per simultaneous call Licensing Not per user

Pricing

StartUp (Free)

Free

  • Small-team calling
  • Cloud-hosted

Pro

Per simultaneous call — see pricelist

  • Mid-tier features
  • CRM integration

Enterprise

Per simultaneous call — see pricelist

  • Full feature set

Security

Signed desktop app compromised in a 2023 nation-state supply-chain attack; repeated CVEs and exposure alerts since.

  • 2023 double supply-chain attackTwo linked compromises pushed trojanized desktop app updates; MITRE tracks it as campaign C0057.¹
  • CVE-2023-49954SQL injection vulnerability in 3CX CRM integration.⁴
  • Local privilege escalation (Aug 2024)Reported by Praetorian in 3CX Phone System.³
  • Recurring exposure alertsJune 2026 hotfix required for self-hosted deployments; publicly exposed instances flagged.⁵

What users say

Splits hard: fans cite price, features, and ease of use, while detractors cite poor support and security baggage.

“The support of 3CX is absolutely ab…”
Reddit, r/3CX
“We used 3CX previously, and we had…”
Reddit, r/3CX
“I like that 3CX has an easy…”
G2 review

Companies that use it

  • Pepsi11
  • Avante Care
  • Harrisburg Academy
  • Austen Consultants
Full analysis

Based on 20+ public sources including Reddit, Wired, MITRE, G2, and 3CX's own site. Review snippets were truncated in the source feed.

Capable, budget-friendly PBX for hands-on IT teams — but a 2023 nation-state supply-chain attack and weak support are real risks.

Methodology

Based on 20+ public sources including Reddit, Wired, MITRE, G2, and 3CX's own site. Review snippets were truncated in the source feed.

Sources

  1. The Huge 3CX Breach Was Actually 2 Linked Supply Chain Attacks — Wiredwired.com
    news
  2. 3CX Supply Chain Attack, Campaign C0057 — MITREattack.mitre.org
    security
  3. 3CX Phone System Local Privilege Escalation — Praetorianpraetorian.com
    security
  4. CVE-2023-49954 — SentinelOnesentinelone.com
    security
  5. Security Alert: Update your Self-Hosted 3CX Deployment3cx.com
    official
  6. Moving away from 3CX — Redditreddit.com
    review
  7. Stay away from 3CX — Redditreddit.com
    review
  8. 3CX Reviews 2026 — G2g2.com
    review
  9. 3CX Reviews from Real Users — TrustRadiustrustradius.com
    review
  10. 3CX Pricelist for PRO and Enterprise Editions3cx.com
    official
  11. Leading 3CX Customers3cx.com
    official
  12. Is it really that bad? — Redditreddit.com
    review

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.