device with bad mask or subnet, recover workaround

Some duba$$ has misconfigured a device on remote network with a bad gateway or netmask. Result is that device is not reachable outside the subnet. Current mask or gw is unknown. Device is pignable from rb951

The only device on that network that can be managed is the router.
Any suggestion on how to tunnel from remote windows box to local subnet without routing ? L2TP, proxy-arp, NAT ?

If the device has telnet or ssh service running then you can login on it from RB951directly and change network settings.