Indeed, you can change the admin account password via the web interface, but the root account is still lurking on the system. I've not checked anything after 4.6 to see if the root account password was changed along with the admin password.

It's shocking how bad the implementation is if some random packets to the IP stack can cause the entire system to fall over, there are other implementaion fails too - not being able to install certificates to prevent man-in-the-middle attacks is near the top of the list.