How does a PBX get hacked?

Could you please elaborate on how a Private Branch Exchange (PBX) system might be vulnerable to hacking? I'm interested in understanding the various methods that attackers might employ to gain unauthorized access to such systems, as well as the potential consequences of a successful hack. Are there any common vulnerabilities that PBX systems tend to share, or are the methods of attack highly specific to individual systems? Additionally, how can organizations protect their PBX systems from such attacks, and what steps should they take if they suspect that their system has been compromised?