According to RasPlex, "The root filesystem is read only (squashfs). This prevents the ability to change the root password, but also prevents an attacker from modifying the filesystem."
A remote attacker may gain root access to the device.
The CERT/CC is currently unaware of a full solution to this issue. Affected users may consider the following mitigations:
Disable SSH password access
Disable the use of password access to SSH, and enable SSH keys instead.
RasPlex notes that "users can simply disable SSH via the dialog if they are worried about being compromised."
Build with a different password
Developers may build their own distribution of OpenELEC or RasPlex from source and modify the root password at build time. Users should be aware however that this password is still hard-coded and may leave a user vulnerable to further attack; future password changes would require another rebuild and deployment.
Restrict network access
Use a firewall or similar technology to restrict access to trusted hosts, networks, and services.