The file VsSetCookie.exe exists on this webserver. Some versions of this file are vulnerable to remote exploit.

remove it from /cgi-bin. To manually test the server, you can try: http://<serverip>/cgi-bin/VsSetCookie.exe?vsuser=<user_name> With a correctly guessed User Name, you will gain full access to the CGI. *** As openvas solely relied on the banner of the remote host *** this might be a false positive