Technically, it's not a vuln because if you enable SSH via the supported route then you only get a root shell and there's no way to create low priv'd SSH users, but since there's no ability to persistently fix that issue, I ended up abusing IPC to write to the persistent storage a scheduled job which will give me a low priv'd SSH user .
https://gist.github.com/timb-machine/a3b2d27adcbbed34455e78f845198392
It just so happens that /if/ you did have a low priv'd SSH user, then the IPC would enable you to get root.
