Put a router in front of the 3cx and block all external requests to your 3cx system. You may allow only trusted addresses or use VPN tunnels. Mikrotik is inexpensive and powerful choice.
Consider also upgrade (purchase of new licenses in your case) to version 10, which is self-protected.
Regards