What does this flow output?
(NOTE: change the http/https and IP in the function as required)
[{"id":"4816c6bb62da7b02","type":"inject","z":"b872cb4b.5a6448","name":"Click me","props":[],"repeat":"","crontab":"","once":false,"onceDelay":0.1,"topic":"","x":1260,"y":120,"wires":[["4816c6bb62da7b03"]]},{"id":"4816c6bb62da7b03","type":"function","z":"b872cb4b.5a6448","name":"","func":"//original curl: \n//\n//curl http://1.2.3.4/api/router/login -d \"pwd=XXYYZZAABB\"\n\nmsg.method = \"post\";\nmsg.url = \"http://1.2.3.4/api/router/login\";\nmsg.payload = `pwd=XXYYZZAABB`;\nmsg.headers = null;\nmsg.cookies = null;\n\nreturn msg;","outputs":1,"noerr":0,"initialize":"","finalize":"","libs":[],"x":1440,"y":120,"wires":[["4816c6bb62da7b04"]]},{"id":"4816c6bb62da7b04","type":"http request","z":"b872cb4b.5a6448","name":"","method":"use","ret":"txt","paytoqs":"ignore","url":"","tls":"","persist":false,"proxy":"","authType":"","x":1620,"y":120,"wires":[["4816c6bb62da7b05"]]},{"id":"4816c6bb62da7b05","type":"debug","z":"b872cb4b.5a6448","name":"","active":true,"tosidebar":true,"console":false,"tostatus":false,"complete":"true","targetType":"full","statusVal":"","statusType":"auto","x":1780,"y":120,"wires":[]}]
Assuming curl works, this response suggests curl is sending more in the http request that you believe (something like a header or cookie that you will need to add to the msg for the node-red http request node). Do you have wireshark installed? Or perhaps postman? (something to fully inspect the request and the response outside of node-red)
Also, see these posts for similar / related tips and clues...
