If you ever find yourself in a position of locking root user on an ESXi host, there is an easy way out.

Since the CVM communicates to the local host via a dedicated network handled by vSwitchNutanix it is possible to clear the lock for the ESXi host from the CVM. 

Verify first that the account is locked. Typically, authentication via an SSH session fails while the DCUI accepts the credentials. 

Log in to a CVM and call for the account lock rest remotely while connecting to the internal IP of the host. 

For more details on the verification and the process itself, refer to KB-5703 ESXi root password does not work via SSH, but works via DCUI.

For an overview of networking vSphere Administration Guide for Acropolis (using HTML 5 Client) AOS 5.18: Networking Components.