If you can plug another phone into the exact same Ethernet cable and get it to light up but the other sixteen phones do nothing, not even light up the headset/mute/speaker buttons (in sequence) then they are likely DOA. Open an RMA case with Cisco.
For the one that does power up but doesn't upgrade, what happens on the screen? It should show you some output if you watch carefully.
Does it get a DHCP address?
If yes, does the address shown come from a pool with Option 150 set correctly?
Can you source ping from that subnet to the CUCM IP?
Does it pull down any of the files at all or show a timeout?
Does it show an error (e.g. Auth Error)?
What does a Wireshark (SPAN port from the switch) show for traffic on that port?
Please remember to rate helpful responses and identify helpful or correct answers.