Are you talking about stand alone phones at remote sites?
There is a Samsung product bulletin 2012-10-16 that describes the "best practices" for a firewall between the lan and the Samsung but I don't think the hackers are attacking individual phones or at least I have not seen that reported.
One of my customers removed the internet cable from the Samsung LAN port and all the rebooting stopped so it appears the attacks are coming in but not changing software. In my previous post someone else was talking about being able to still get in WITH the password changed.
https://sundance-communications.com/forum/ubbthreads.php/topics/537933#Post537933