If I enable HTTPS and log into the NVR's web interface, the following 'call' (i.e. GET) works in a second browser tab:
https://<ip>/ISAPI/System/deviceinfo
I do not have to provide any additional authorization because there's a 'web session' cookie. As soon as I log out of the NVR's web...