shouldiuse.io

New check

Categories

VERDICT

Should I use FreePBX?

Open source, web-based IP PBX management tool - freepbx.org

Depends. Buy if you have Linux/VoIP admin skills and will patch fast — the core is free and deep. Skip if you want phones that just work without becoming your own security team.

Confidence

Medium. Based on 20+ public sources: G2, Reddit, FreePBX forum, NVD, Horizon3, and government advisories

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support quality
  • Security posture

Pricing

Free

FreePBX Open Source

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
Commercial Add-Ons$299/yr example: 20-user softphones
PBXact Cloud (Hosted)Priced via Sangoma portal

Best for

  • MSPs managing many client phone systems
  • Companies with in-house VoIP/Linux admins
  • Call centers needing full control
  • Homelabbers learning telephony

Not for

  • Non-technical teams wanting plug-and-play phones
  • Anyone without staff to patch zero-days within days
  • Small businesses that just need a dial tone — buy hosted VoIP
  • Servers you'll expose to the internet and forget

Gotchas - check before you buy

high

August 2025 zero-day let attackers root unpatched, internet-facing servers; emergency patch required

high

Vendor itself urges locking down admin access — exposed admin GUIs are the top attack path

medium

Commercial modules are per-license Sangoma add-ons; a 20-user softphone pack runs $299/year

medium

Free version means community-forum support only; real support requires Sangoma/PBXact purchases

Pros and cons

Pros

  • Completely free to download with an open-source core
  • Full PBX: IVR, SIP trunks, call center, endpoint management
  • Described as the number-one Asterisk GUI on AWS Marketplace
  • Deploy on your own hardware, cloud, or certified Sangoma appliances
  • Large, active community for troubleshooting and modules

Cons

  • Critical unauthenticated RCE zero-days actively exploited in 2025
  • Secure deployment demands VoIP and Linux skills most teams lack
  • Key features (softphones, endpoint manager) sit behind paid Sangoma licenses
  • Users say some features lag rival VitalPBX
  • Long-time users report frustration and uneven support

Sources & method

Analyzed 9/27/2026 - 12 sources - Multiple critical 2025 vulnerabilities, including actively exploited unauthenticated RCE; requires rapid patching and lockdown

official x3review x4security x4news x1
  • CVE-2025-57819 — unauthenticated remote code execution, actively exploited, August 2025 zero-day targeting FreePBX admin access; emergency patch released and public exploit code published
  • CVE-2025-66039 and related CVEs, Horizon3 attack research chain documented additional critical FreePBX flaws
  • CVE-2025-61678 — Endpoint Manager RCE, Endpoint Manager module vulnerability allowing remote code execution
  • Government advisory AV25-831, Canadian Centre for Cyber Security issued a FreePBX security advisory in December 2025

Key stats

  • Value for money: 5/5

    Rating

  • Free

    Starting price

  • 12

    Sources

  • Analyzed

  • Value for money: 5/5. Free core rivals paid PBX feature sets
  • Ease of use: 3/5. Web GUI beats raw Asterisk; still needs admin skills
  • Feature depth: 5/5. IVR, SIP trunks, call center, endpoint management
  • Support quality: 2/5. Community forums; paid support is Sangoma-only
  • Security posture: 2/5. Actively exploited 2025 zero-days; patching falls on you
  • 7.9/10 User rating checkthat.ai aggregate review score
  • Free Starting price core open source; paid Sangoma add-ons
  • Yes Free tier 'Completely free to download' per vendor

Pricing

FreePBX Open Source

Free

  • Core PBX: extensions, trunks, IVR
  • Self-hosted and self-secured
  • Community support only

Commercial Add-Ons

$299/yr example: 20-user softphones

  • Sangoma-licensed modules
  • Endpoint manager, call center features

PBXact Cloud (Hosted)

Priced via Sangoma portal

  • Managed hosting
  • Commercial modules bundled

Security

Multiple critical 2025 vulnerabilities, including actively exploited unauthenticated RCE; requires rapid patching and lockdown

  • CVE-2025-57819 — unauthenticated remote code execution, actively exploitedAugust 2025 zero-day targeting FreePBX admin access; emergency patch released and public exploit code published⁸
  • CVE-2025-66039 and related CVEsHorizon3 attack research chain documented additional critical FreePBX flaws⁹
  • CVE-2025-61678 — Endpoint Manager RCEEndpoint Manager module vulnerability allowing remote code execution
  • Government advisory AV25-831Canadian Centre for Cyber Security issued a FreePBX security advisory in December 202511

What users say

Users praise FreePBX's flexibility and free price but flag the security burden, paid module creep, and uneven support.

“FreePBX is brilliant, but some features need to catch up with VitalPBX”
FreePBX Community Forum
“FreePBX is asterisk plus a web gui”
Reddit, r/homelab
“FreePBX is the number-one GUI”
AWS Marketplace review

Alternatives

Compare FreePBX with each alternative.

  • FusionPBX

    FreeSWITCH-based alternative debaters compare head-to-head

Full analysis

Based on 20+ public sources: G2, Reddit, FreePBX forum, NVD, Horizon3, and government advisories

Free, powerful Asterisk PBX — but 2025 zero-days mean you must be your own VoIP security team.

Methodology

Based on 20+ public sources: G2, Reddit, FreePBX forum, NVD, Horizon3, and government advisories

Sources

  1. FreePBX official sitefreepbx.org
    official
  2. FreePBX Add-Ons (licensing)freepbx.org
    official
  3. FreePBX Hosted / PBXact Cloudfreepbx.org
    official
  4. G2 reviews — FreePBXg2.com
    review
  5. checkthat.ai FreePBX rating (7.9/10)checkthat.ai
    review
  6. Reddit r/msp — Thoughts on FreePBX?reddit.com
    review
  7. FreePBX forum — brilliant but features lag VitalPBXcommunity.freepbx.org
    review
  8. NVD — CVE-2025-57819nvd.nist.gov
    security
  9. Horizon3 — FreePBX CVE-2025-66039 researchhorizon3.ai
    security
  10. The Hacker News — actively exploited zero-daythehackernews.com
    news
  11. Cyber Centre advisory AV25-831cyber.gc.ca
    security
  12. Sangoma advisory — lock down admin accesscommunity.freepbx.org
    security

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.