How do you expect to ssh in with root/root if the password was changed? If root doesn't work for the webui pass it won't work for ssh either(barring some very unusual configuration). You should upgrade the firmware as soon as you are able to login as you are most likely on the very dangerous oct 24th firmware. If you can't get the password from the seller you will have to use a TTL cable to reset/reflash it manually.
Because SSH and webui logins are entirely separate, changing the webui password has no impact on the SSH password. The entire point is that he can't log into the webui and so must use SSH access, else he will likely have to send the controller in.
The Oct 24 firmware is also NOT dangerous, its stable as hell and would be great if it didn't have broken reset button functionality.
No they are not separate, I just verified this again to be sure, changing the webui password changes the ssh password. The Oct 24 firmware uses the wrong(corruption prone) filesystem, normally there is a read/write overlayfs on top of a read only filesystem, however the Oct 24 firmware uses a single read/write filesystem for everything. By not using the overlayfs all changes are permanent which is why the reset button does nothing on the Oct 24 firmware. The reset button clears the overlay filesystem on the normal firmware but since the Oct 24 firmware doesn't have overlayfs it does nothing. Not having the read only filesystem means the chance of flash memory corruption is significantly higher on the Oct 24 firmware which is why one should flash the latest version as soon as possible.