During deployment of NetScaler instances (VPX) on an SDX appliance the nsroot account is configured with the password given in the admin profile. This account is also used for inventory, configuration and management of the instances through the Service VM.
If you want to change the nsroot password later on, you must not do this in the instance itself, because the Service VM won’t be able to get inventory, configuration or change anything in this instance anymore. Instead, create a new admin profile with the new password and assign it to the instances through Configuration –> Instances –> Modify. This process will also try to set other basic settings and may run on a failure (for example if you changed the default gateway meanwhile), but it will still apply the new password to nsroot. Now you have to log on using the new password for nsroot (although you should actually use other authentication means for administration usually) and the SDX Service VM can still manage the instance.