First. It is necessary to ensure that the nvr settings recovery record not only access to a web browser and recovery record and access to cameras streams (if there is such a setting). As it is often a tick "to restrict rtsp access". Authentication setting for rtsp protocol. If there is no such a tick (or is disabled for the authorization of the protocol), then via rtsp protocol can receive the stream from the cameras and without a password.
Secondly, you need to make sure that the password is not too simple (like admin / admin) because usually Xeoma for the convenience of users itself can choose such passwords.