This answer assumes you mean Solaris 10 zones.
I think the simplest way would be to write a simple change_passwd.ksh script and copy to each non-global zone and run it locally there.
You could try to do it all from the global zone via an ssh script that logs in to non-global zones, but it would be messy to do and error check.
I know you can cd (if root) down from the global into a non-global zone, but you're still in global zone context.
I don't know of a way to switch context into non-global when you get there.