I understand that if a system uses AES in CTR mode (or other modes) without authentication that an attacker can flip bits to try to get the system to do something it wasn't intended to do (or wasn't intended for the attacker specifically to do).
What is not so clear is, does the lack of authentication mean that the attacker can somehow recover the plain text? I'm specifically thinking of a case where firmware is encrypted with AES-CTR but has no authentication. The attacker can take publicly available encrypted firmware intended for the device, alter it, and send it to the device. Is the attacker somehow able to decrypt the firmware by doing this?