The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2909 advisory. - In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2) even without server authentication. (CVE-2021-45079) Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
SUSE SLED15 / SLES15 Security Update : strongswan (SUSE-SU-2022:0492-1)
openSUSE 15 Security Update : strongswan (openSUSE-SU-2022:0492-1)
Ubuntu 18.04 LTS / 20.04 LTS / 21.10 : strongSwan vulnerability (USN-5250-1)
FreeBSD : strongswan - Incorrect Handling of Early EAP-Success Messages (ccaea96b-7dcd-11ec-93df-00224d821998)