Cryptographic key disclosure via hardcoded session keys

Hardcoded credentials in Phoenix Contact WP 6xxx panels before 4.0.10 allow remote authenticated users to read session cryptographic keys. The firmware stores session cryptographic keys as fixed values that an administrator can retrieve and use to create syntactically valid cookies. Administrator privileges are required, and the forged cookies alone cannot establish a valid device session, so the flaw does not directly bypass authentication.